Vulnerability · Published Jan 18, 2024 · Assigned by ProgressSoftware
CVE-2023-40051Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
Critical 9.1
In plain English
A critical-severity unrestricted file upload in OpenEdge from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | OpenEdge | 11.7.0 – before 11.7.1812.2.0 – before 12.2.13Innovation Releases – before 12.8.0 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L