PT-2024-38482 · Progress+1 · Openedge Management+1

Published 2024-09-03 · Updated 2024-09-05 · CVE-2024-7654

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEdge Management versions prior to 12.8.1

Description The issue concerns an ActiveMQ Discovery service that was reachable by default from an OpenEdge Management installation when the OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface, making it possible for other types of attacks that could spoof or deceive web interface users.

Recommendations For OpenEdge Management versions prior to 12.8.1, upgrade the affected component immediately to remediate the unauthorized use of the OEE/OEM discovery service. As a temporary workaround, consider deactivating the discovery service by default until a patch is available. Restrict access to the vulnerable ActiveMQ Discovery service to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7654

Affected Products

Activemq

Openedge Management

References · 11

• https://osv.dev/vulnerability/CVE-2024-7654 · Vendor Advisory
• https://community.progress.com/s/article/Unauthenticated-Content-Injection-in-OpenEdge-Management-web-interface-via-ActiveMQ-discovery-service · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7654 · Security Note
• https://t.me/cvedetector/4696 · Telegram Post
• https://t.me/cvenotify/93099 · Telegram Post
• https://t.me/latest_high_impact_cve/1098 · Telegram Post
• https://twitter.com/oktsec/status/1831002809401020654 · Twitter Post
• https://twitter.com/CVEnew/status/1830981931015557156 · Twitter Post
• https://t.me/cvenotify/93341 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1831022660886605939 · Twitter Post
• https://twitter.com/CveFindCom/status/1830984808018710966 · Twitter Post