by Kastro
Paper/Archive/CVE-2024-7345

CVE-2024-7345

Progress OpenEdge — Direct local client connections to MS Agents can bypass authentication

EPSS 0.6%CVSS 9.6
critical.is priorityof 100
38
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 48.2.482 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms

Affected

ProductAffectedFixed inSource
OpenEdge11.7.0 – 11.7.19–CNA
OpenEdge12.2.0 – 12.2.1412.8.0CNA
openedge11.7.0 – 11.7.19–CISA-ADP
openedge12.2.0 – 12.2.1412.8.0CISA-ADP

Scores by source

NVD9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ProgressSoftware (CNA)8.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorycommunity.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication