Vulnerability · Published Jan 18, 2024 · Assigned by ProgressSoftware
CVE-2023-40052Progress Application Server (PAS) for OpenEdge Denial of Service
High 7.5
In plain English
A high-severity memory corruption in OpenEdge from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 . An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | OpenEdge | 11.7.0 – before 11.7.1812.2.0 – before 12.2.13Innovation Releases – before 12.8.0 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H