CVE-2023-40052 Progress Application Server (PAS) for OpenEdge Denial of Service

High 7.5 Published 18 Jan 2024 Updated 29 Aug 2024

An attacker can crash the Progress Application Server agent by sending malformed web requests, disrupting service for multiple clients.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-40052?

CVE-2023-40052 is a high-severity denial of service vulnerability in Progress Software Corporation OpenEdge, published on 18 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0

An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests.

Weakness: CWE-119

Which versions are affected by CVE-2023-40052?

It affects 2 products.

Products include Progress Openedge, Progress Openedge Innovation.

How do I fix CVE-2023-40052?

No fix has been published for CVE-2023-40052 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-40052 being exploited?

There is no known exploitation of CVE-2023-40052 in the wild and no public exploit code.

Sources

Also known as GHSA-559p-m25r-rqhm.