2024-07-31 18:00:37 +00:00
{
2024-09-03 15:00:34 +00:00
"data_version" : "4.0" ,
2024-07-31 18:00:37 +00:00
"data_type" : "CVE" ,
"data_format" : "MITRE" ,
"CVE_data_meta" : {
"ID" : "CVE-2024-7345" ,
2024-09-03 15:00:34 +00:00
"ASSIGNER" : "security@progress.com" ,
"STATE" : "PUBLIC"
2024-07-31 18:00:37 +00:00
} ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2024-09-03 15:00:34 +00:00
"value" : "Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms"
}
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-94 Improper Control of Generation of Code ('Code Injection')" ,
"cweId" : "CWE-94"
}
]
}
]
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "Progress" ,
"product" : {
"product_data" : [
{
"product_name" : "OpenEdge" ,
"version" : {
"version_data" : [
{
"version_value" : "not down converted" ,
"x_cve_json_5_version_data" : {
"versions" : [
{
"lessThanOrEqual" : "11.7.19" ,
"status" : "affected" ,
"version" : "11.7.0" ,
"versionType" : "custom"
} ,
{
"lessThanOrEqual" : "12.2.14" ,
"status" : "affected" ,
"version" : "12.2.0" ,
"versionType" : "custom"
} ,
{
"status" : "unaffected" ,
"version" : "12.8.0" ,
"versionType" : "custom"
}
] ,
"defaultStatus" : "affected"
}
}
]
}
}
]
}
}
]
}
} ,
"references" : {
"reference_data" : [
{
"url" : "https://community.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication" ,
"refsource" : "MISC" ,
"name" : "https://community.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication"
}
]
} ,
"generator" : {
"engine" : "Vulnogram 0.2.0"
} ,
"source" : {
"discovery" : "UNKNOWN"
} ,
"configuration" : [
{
"lang" : "en" ,
"supportingMedia" : [
{
"base64" : false ,
"type" : "text/html" ,
"value" : "An active instance of OpenEdge PASOE's Tomcat Webserver and local or system adjacent access to an ABL client on the Webserver host<br>"
}
] ,
"value" : "An active instance of OpenEdge PASOE's Tomcat Webserver and local or system adjacent access to an ABL client on the Webserver host"
}
] ,
"work_around" : [
{
"lang" : "en" ,
"supportingMedia" : [
{
"base64" : false ,
"type" : "text/html" ,
"value" : "<div>Do not put client software on host webserver systems<br></div>"
}
] ,
"value" : "Do not put client software on host webserver systems"
} ,
{
"lang" : "en" ,
"supportingMedia" : [
{
"base64" : false ,
"type" : "text/html" ,
"value" : "Ensure the \"AppServer.SessMgr.agentHost\" property is set to \"localhost\" unless you are multi-hosting a single Webserver system<br>"
}
] ,
"value" : "Ensure the \"AppServer.SessMgr.agentHost\" property is set to \"localhost\" unless you are multi-hosting a single Webserver system"
} ,
{
"lang" : "en" ,
"supportingMedia" : [
{
"base64" : false ,
"type" : "text/html" ,
"value" : "Block agent listening ports from network access anywhere with the exception of the PASOE Tomcat Webserver's published listening port<br>"
}
] ,
"value" : "Block agent listening ports from network access anywhere with the exception of the PASOE Tomcat Webserver's published listening port"
} ,
{
"lang" : "en" ,
"supportingMedia" : [
{
"base64" : false ,
"type" : "text/html" ,
"value" : "Launch PASOE agent processes with \"least privilege\" system resource capabilities<br>"
}
] ,
"value" : "Launch PASOE agent processes with \"least privilege\" system resource capabilities"
}
] ,
"solution" : [
{
"lang" : "en" ,
"supportingMedia" : [
{
"base64" : false ,
"type" : "text/html" ,
"value" : "Use the 12.8.0 or above LTS release where the vulnerability does not exist<br>"
}
] ,
"value" : "Use the 12.8.0 or above LTS release where the vulnerability does not exist"
} ,
{
"lang" : "en" ,
"supportingMedia" : [
{
"base64" : false ,
"type" : "text/html" ,
"value" : "Use the 12.2 LTS release at the 12.2.14 Update level or above<br>"
}
] ,
"value" : "Use the 12.2 LTS release at the 12.2.14 Update level or above"
} ,
{
"lang" : "en" ,
"supportingMedia" : [
{
"base64" : false ,
"type" : "text/html" ,
"value" : "Use the 11.7 LTS release at the 11.7.19 Update level or above\n\n<br>"
}
] ,
"value" : "Use the 11.7 LTS release at the 11.7.19 Update level or above"
}
] ,
"impact" : {
"cvss" : [
{
"attackComplexity" : "HIGH" ,
"attackVector" : "ADJACENT_NETWORK" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 8.3 ,
"baseSeverity" : "HIGH" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"scope" : "CHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" ,
"version" : "3.1"
2024-07-31 18:00:37 +00:00
}
]
}
}