PT-2024-38278 · Progress · Openedge

Published 2024-09-03 · Updated 2024-09-07 · CVE-2024-7345

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEdge LTS versions prior to 11.7.18 OpenEdge LTS versions prior to 12.2.13

Description A Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms.

Recommendations For OpenEdge LTS versions prior to 11.7.18, update to a version later than 11.7.18 to resolve the issue. For OpenEdge LTS versions prior to 12.2.13, update to a version later than 12.2.13 to resolve the issue. As a temporary workaround, consider restricting access to the Multi-Session Agents until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-7345

Affected Products

Openedge

References · 10

• https://community.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7345 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7345 · Vendor Advisory
• https://t.me/latest_high_impact_cve/1098 · Telegram Post
• https://twitter.com/CVEnew/status/1830988290171834559 · Twitter Post
• https://twitter.com/CveFindCom/status/1830984879745438111 · Twitter Post
• https://t.me/cvenotify/93097 · Telegram Post
• https://t.me/cvedetector/4698 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1831018875716067402 · Twitter Post
• https://twitter.com/cracbot/status/1832660220507816446 · Twitter Post