This vulnerability (CVE-2024-39847) involves improper restriction of XML External Entity references (CWE-611) in the XML parser functionality of 4D Server's SOAP endpoints. An unauthenticated attacker can leverage this flaw to read arbitrary files on the server and connected network shares, as well as initiate HTTP GET requests to arbitrary services, potentially leading to information disclosure and network reconnaissance. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. The vulnerability affects all versions of 4D Server. No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to read sensitive files on the affected 4D Server and adjacent network shares, potentially exposing confidential data. Additionally, attackers can perform HTTP GET requests to arbitrary services, which may facilitate further network reconnaissance or indirect attacks. The vulnerability does not require privileges or user interaction, increasing its risk. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, organizations should monitor 4D's official channels for updates. Until a patch is available, consider restricting access to SOAP endpoints from untrusted networks and applying network-level controls to limit exposure. Avoid exposing the 4D Server SOAP endpoints to the internet or untrusted networks where possible.