CVE-2024-1403

CRITICAL

OpenEdge < 11.7.19 - Authentication Bypass via Credential Handling Failure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-1403. PoCs published by horizon3ai.

AI-analyzed exploit summary This repository contains a functional Java exploit for CVE-2024-1403, an authentication bypass vulnerability in Progress OpenEdge. The PoC leverages RMI to connect to the AdminServer interface using a crafted 'NT AUTHORITY\SYSTEM' credential, demonstrating unauthorized access to system plugins.

Description

In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.  The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.  

Exploits (1)

nomisec WORKING POC 16 stars
by horizon3ai · poc
https://github.com/horizon3ai/CVE-2024-1403

This repository contains a functional Java exploit for CVE-2024-1403, an authentication bypass vulnerability in Progress OpenEdge. The PoC leverages RMI to connect to the AdminServer interface using a crafted 'NT AUTHORITY\SYSTEM' credential, demonstrating unauthorized access to system plugins.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Progress OpenEdge (version not specified)
No auth needed
Prerequisites: Access to target RMI interface (port 20931) · Required JAR files (progress.jar, oeauth-12.8.0.jar, osmetrics.jar, juniper.jar)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 10.0
EPSS 0.0327
EPSS Percentile 86.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-305
Status published
Products (1)
progress/openedge < 11.7.19
Published Feb 27, 2024
Tracked Since Feb 18, 2026