CVE-2023-34203
High
Description
In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Progress Openedge
PublishedJun 23, 2023
First seenJun 23, 2023
How to fix
Update
- progress openedge11.7.16, 12.2.12, 12.7 or later
- progress openedge_explorer12.7 or later
- progress openedge_management12.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| progress openedge | v < 11.7.16, 12.0 ≤ v < 12.2.12, 12.3 ≤ v < 12.7 | 11.7.16, 12.2.12, 12.7 |
| progress openedge_explorer | v < 12.7 | 12.7 |
| progress openedge_management | v < 12.7 | 12.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.