Progress Vulnerabilities and Affected Products
Vulnerabilities associated with openedge.
Products
Clear product- MOVEit Transfer22 vulnerabilities
- whatsup_gold21 vulnerabilities
- LoadMaster11 vulnerabilities
- telerik_reporting8 vulnerabilities
- ws_ftp_server6 vulnerabilities
- openedge5 vulnerabilities
- whatsupgold5 vulnerabilities
- ui_for_wpf4 vulnerabilities
- moveit_transfer3 vulnerabilities
- ShareFile Storage Zones Controller3 vulnerabilities
- sitefinity3 vulnerabilities
- WhatsUp Gold3 vulnerabilities
- DataDirect Connect for JDBC Autonomous REST Connector2 vulnerabilities
- DataDirect Connect for JDBC for Amazon Redshift2 vulnerabilities
- DataDirect Connect for JDBC for Apache Cassandra2 vulnerabilities
- DataDirect Connect for JDBC for Apache Impala2 vulnerabilities
- DataDirect Connect for JDBC for Apache SparkSQL2 vulnerabilities
- DataDirect Connect for JDBC for DB22 vulnerabilities
- DataDirect Connect for JDBC for Google Analytics 42 vulnerabilities
- DataDirect Connect for JDBC for Google BigQuery2 vulnerabilities
- DataDirect Connect for JDBC for Greenplum2 vulnerabilities
- DataDirect Connect for JDBC for Hive2 vulnerabilities
- DataDirect Connect for JDBC for Informix2 vulnerabilities
- DataDirect Connect for JDBC for Microsoft Dynamics 3652 vulnerabilities
- DataDirect Connect for JDBC for Microsoft Sharepoint2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-7346HIGH | Client connections using default TLS certificates from OpenEdge may bypass TLS host name validationHost name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security. The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that co… | CVSS7.2v3.1 | EPSS0.162% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-7345HIGH | Direct local client connections to MS Agents can bypass authenticationLocal ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms CWE-94Sep 3, 2024 | CVSS8.3v3.1 | EPSS0.59% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-7654HIGH | Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery serviceAn ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other types of attack that could spoof or deceive web interface users. Unauthorized use of the OEE/OEM discovery service was remediated by deactivating the discovery service by default. CWE-79Sep 3, 2024 | CVSS8.3v3.1 | EPSS0.294% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1403CRITICAL | Authentication Bypass in OpenEdge Authentication Gateway and AdminServerIn OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication. CWE-305Feb 27, 2024 | CVSS10.0v3.1 | EPSS3.3% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-40052HIGH | Progress Application Server (PAS) for OpenEdge Denial of ServiceThis issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 . An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests. CWE-119Jan 18, 2024 | CVSS7.5v3.1 | EPSS0.57% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |