Vulnerability · Published Sep 3, 2024 · Assigned by ProgressSoftware

CVE-2024-7654Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service

High 8.3

In plain English

A high-severity cross-site scripting in OpenEdge from Progress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.3%top 77.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other types of attack that could spoof or deceive web interface users. Unauthorized use of the OEE/OEM discovery service was remediated by deactivating the discovery service by default.

Affected products (as reported)

Vendor	Product	Versions
Progress	OpenEdge	11.7.0 – before 11.7.1912.2.0 – before 12.2.1512.8.0 – before 12.8.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://community.progress.com/s/article/Unauthenticated-Content-Injection-in-OpenEdge-Management-web-interface-via-ActiveMQ-discovery-service vendor-advisory