← Back

CVE-2024-7345

nvd nist
Published: Sep 3, 2024Modified: Jun 17, 2026

JSON object

Loading...
9.6
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 6.0
Source: NVD

Description

Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms

Affected (2)

Products: Progress: Openedge
Progress
1 product
Openedge
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Progress
Openedge
Up to 11.7.18
Openedge
From 12.0 to 12.2.13

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (1)

Source: security@progress.com
MitigationVendor Advisory

Timeline

No history available yet.