Lucene search

ProgressSoftwareCVE-2024-7345

HistorySep 03, 2024 - 3:15 p.m.

CVE-2024-7345

2024-09-0315:15:16

CWE-94

ProgressSoftware

web.nvd.nist.gov

cve-2024-7345; authentication bypass; code injection; openedge lts; security checks; unauthorized access; ms agents; abl client; pasoe platform

CVSS3

9.6

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.001

Percentile

17.9%

JSON

Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms

Affected configurations

Nvd

Node

progressopenedgeRange≤11.7.18

progressopenedgeRange12.0–12.2.13

VendorProductVersionCPE
progressopenedge*cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
progress	openedge	*	cpe:2.3:a:progress:openedge::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "PASOE Application Server",
      "OpenEdge Authentication Gateway"
    ],
    "platforms": [
      "Windows",
      "Linux",
      "64 bit",
      "x86",
      "32 bit"
    ],
    "product": "OpenEdge",
    "vendor": "Progress",
    "versions": [
      {
        "lessThanOrEqual": "11.7.19",
        "status": "affected",
        "version": "11.7.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "12.2.14",
        "status": "affected",
        "version": "12.2.0",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "12.8.0",
        "versionType": "custom"
      }
    ]
  }
]

References

community.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication

CVSS3

9.6

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.001

Percentile

17.9%

JSON

Related for CVE-2024-7345