Lucene search

[email protected]CVE-2023-34203

HistoryJun 23, 2023 - 8:15 p.m.

CVE-2023-34203

2023-06-2320:15:09

CWE-74

[email protected]

web.nvd.nist.gov

cve-2023-34203

openedge oem

openedge management

oee

openedge explorer

url injection

identity change

role membership

security vulnerability

admin escalation

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

31.7%

JSON

In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.

CPENameOperatorVersion
progress:openedgeprogress openedgelt11.7.16
progress:openedgeprogress openedgelt12.2.12
progress:openedgeprogress openedgeeq12.0
progress:openedgeprogress openedgelt12.7
progress:openedgeprogress openedgeeq12.3
progress:openedge_explorerprogress openedge explorerlt12.7
progress:openedge_explorerprogress openedge explorereq-
progress:openedge_managementprogress openedge managementlt12.7
progress:openedge_managementprogress openedge managementeq-

CPE	Name	Operator	Version
progress:openedge	progress openedge	lt	11.7.16
progress:openedge	progress openedge	lt	12.2.12
progress:openedge	progress openedge	eq	12.0
progress:openedge	progress openedge	lt	12.7
progress:openedge	progress openedge	eq	12.3
progress:openedge_explorer	progress openedge explorer	lt	12.7
progress:openedge_explorer	progress openedge explorer	eq	-
progress:openedge_management	progress openedge management	lt	12.7
progress:openedge_management	progress openedge management	eq	-

References

www.progress.com/openedge

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

31.7%

JSON

Related for CVE-2023-34203

prion1 cvelist1