CVE-2023-40051
Critical
Description
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Progress Openedge
PublishedJan 18, 2024
First seenJan 18, 2024
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- progress openedge11.7.18, 12.2.13 or later
- progress openedge_innovation12.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| progress openedge | 11.7 ≤ v < 11.7.18, 12.2 ≤ v < 12.2.13 | 11.7.18, 12.2.13 |
| progress openedge_innovation | v < 12.8.0 | 12.8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.