by Kastro CVE-2024-1403
Progress OpenEdge — Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
Description · from the CVE record
In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.
Affected
ProductAffectedFixed inSource
OpenEdge11.7.0 – < 11.7.1911.7.19CNA
OpenEdge12.2.0 – < 12.2.1412.2.14CNA
OpenEdge12.8.0 – < 12.8.112.8.1CNA
openedge11.7.0 – < 11.7.1911.7.19CISA-ADP
openedge12.2.0 – < 12.2.1412.2.14CISA-ADP
openedge12.8.0 – < 12.8.112.8.1CISA-ADP
Scores by source
ProgressSoftware (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total