Lucene search

ProgressSoftwareCVE-2024-7654

HistorySep 03, 2024 - 3:15 p.m.

CVE-2024-7654

2024-09-0315:15:17

CWE-79

ProgressSoftware

web.nvd.nist.gov

cve-2024-7654

unauthenticated

content injection

openedge management

activemq

discovery service

unauthorized access

udp port

spoof

deceive

remediated

deactivating

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

17.7%

JSON

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service’s UDP port allowed content injection into parts of the OEM web interface making it possible for other types of attack that could spoof or deceive web interface users. Unauthorized use of the OEE/OEM discovery service was remediated by deactivating the discovery service by default.

Affected configurations

Nvd

Node

progressopenedgeRange≤11.7.19

progressopenedgeRange12.2–12.2.14lts

progressopenedgeRange12.8–12.8.3lts

VendorProductVersionCPE
progressopenedge*cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*
progressopenedge*cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:*

Vendor	Product	Version	CPE
progress	openedge	*	cpe:2.3:a:progress:openedge::::::::
progress	openedge	*	cpe:2.3:a:progress:openedge:::::lts:::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "OpenEdge Explorer",
      "OpenEdge Management"
    ],
    "platforms": [
      "Windows",
      "Linux",
      "x86",
      "64 bit",
      "32 bit"
    ],
    "product": "OpenEdge",
    "vendor": "Progress",
    "versions": [
      {
        "lessThan": "11.7.19",
        "status": "affected",
        "version": "11.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "12.2.15",
        "status": "affected",
        "version": "12.2.0",
        "versionType": "custom"
      },
      {
        "lessThan": "12.8.2",
        "status": "affected",
        "version": "12.8.0",
        "versionType": "custom"
      }
    ]
  }
]

References

community.progress.com/s/article/Unauthenticated-Content-Injection-in-OpenEdge-Management-web-interface-via-ActiveMQ-discovery-service

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-7654