CVE-2024-7654 Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service
Attackers can inject content into the OpenEdge Management web interface via an exposed ActiveMQ discovery service, potentially deceiving users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-7654?
CVE-2024-7654 is a high-severity cross-site scripting vulnerability in Progress OpenEdge, published on 3 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other types of attack that could spoof or deceive web interface users. Unauthorized use of the OEE/OEM discovery service was remediated by deactivating the discovery service by default.
Weakness: CWE-79
Which versions are affected by CVE-2024-7654?
It affects 1 product.
Products include Progress Openedge.
How do I fix CVE-2024-7654?
No fix has been published for CVE-2024-7654 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-7654 being exploited?
There is no known exploitation of CVE-2024-7654 in the wild and no public exploit code.
Other vulnerabilities in Progress OpenEdge
- CVE-2024-1403 Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
- CVE-2007-2417 Memory corruption in n/a
- CVE-2015-9245 Misconfiguration in n/a
- CVE-2023-40051 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
- CVE-2023-34203 Privilege escalation in n/a
Sources
Also known as GHSA-fgc8-q46c-35v5.