CVE-2024-7345 Direct local client connections to MS Agents can bypass authentication
Attackers can bypass authentication via local connections to inject unauthorized code into Multi-Session Agents in Progress OpenEdge.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7345?
CVE-2024-7345 is a high-severity code injection vulnerability in Progress OpenEdge, published on 3 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms
Weakness: CWE-94
Which versions are affected by CVE-2024-7345?
It affects 1 product.
Products include Progress Openedge.
How do I fix CVE-2024-7345?
No fix has been published for CVE-2024-7345 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-7345 being exploited?
There is no known exploitation of CVE-2024-7345 in the wild and no public exploit code.
Other vulnerabilities in Progress OpenEdge
- CVE-2024-1403 Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
- CVE-2007-2417 Memory corruption in n/a
- CVE-2015-9245 Misconfiguration in n/a
- CVE-2023-40051 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
- CVE-2023-34203 Privilege escalation in n/a
Sources
Also known as GHSA-556j-85mj-9j97.