This vulnerability (CWE-611) in 4D Server's SOAP endpoint XML parser allows unauthenticated remote attackers to leverage XML External Entity injection to access sensitive files on the server and adjacent network shares. Additionally, attackers can use the vulnerability to make HTTP GET requests to arbitrary network services, potentially enabling information disclosure or further network reconnaissance. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality. The vulnerability affects all versions of 4D Server. No vendor-provided patch or official remediation level is currently documented.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the affected 4D Server and connected network shares, leading to potential disclosure of sensitive information. Attackers can also perform HTTP GET requests to arbitrary services, which may facilitate further attacks or information gathering. The vulnerability does not require authentication or user interaction, increasing its risk. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to SOAP endpoints and limiting network exposure of the 4D Server. Monitor for updates from 4D regarding patches or mitigations. Avoid exposing the affected service to untrusted networks where possible.