Lucene search

ProgressSoftwareCVE-2024-7346

HistorySep 03, 2024 - 3:15 p.m.

CVE-2024-7346

2024-09-0315:15:16

CWE-287

CWE-297

ProgressSoftware

web.nvd.nist.gov

openedge

tls

certificates

host name validation

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security. The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.

Affected configurations

Nvd

Node

progressopenedgeRange≤11.7.19

progressopenedgeRange12.0–12.2.14lts

VendorProductVersionCPE
progressopenedge*cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*
progressopenedge*cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:*

Vendor	Product	Version	CPE
progress	openedge	*	cpe:2.3:a:progress:openedge::::::::
progress	openedge	*	cpe:2.3:a:progress:openedge:::::lts:::*

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "PASOE Application Server",
      "OpenEdge Authentication Gateway"
    ],
    "platforms": [
      "Windows",
      "Linux",
      "64 bit",
      "x86",
      "32 bit"
    ],
    "product": "OpenEdge",
    "vendor": "Progress",
    "versions": [
      {
        "lessThanOrEqual": "11.7.19",
        "status": "affected",
        "version": "11.7.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "12.2.14",
        "status": "affected",
        "version": "12.2.0",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "12.8.0",
        "versionType": "custom"
      }
    ]
  }
]

References

community.progress.com/s/article/Client-connections-using-default-TLS-certificates-from-OpenEdge-may-bypass-TLS-host-name-validation

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-7346