CVE-2024-1403

In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer	Vendor Advisory
https://www.progress.com/openedge	Product
https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer	Vendor Advisory
https://www.progress.com/openedge	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:openedge:::::lts:::*
	cpe:2.3:a:progress:openedge:::::lts:::*
	cpe:2.3:a:progress:openedge:::::lts:::*

History

11 Feb 2025, 17:40

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
References	~~() https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer -~~	() https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer - Vendor Advisory
References	~~() https://www.progress.com/openedge -~~	() https://www.progress.com/openedge - Product
CPE		cpe:2.3:a:progress:openedge:::::lts:::*
First Time		Progress Progress openedge

Information

Published : 2024-02-27 16:15

Updated : 2025-02-11 17:40

NVD link : CVE-2024-1403

Mitre link : CVE-2024-1403

CVE.ORG link : CVE-2024-1403

JSON object : View

Products Affected

progress

openedge

CWE

CWE-305

Authentication Bypass by Primary Weakness

NVD-CWE-noinfo

{"id": "CVE-2024-1403", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-02-27T16:15:45.643", "references": [{"url": "https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer", "tags": ["Vendor Advisory"], "source": "security@progress.com"}, {"url": "https://www.progress.com/openedge", "tags": ["Product"], "source": "security@progress.com"}, {"url": "https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.progress.com/openedge", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-305"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.\u00a0 The\nvulnerability is a bypass to authentication based on a failure to properly\nhandle username and password. Certain unexpected\ncontent passed into the credentials can lead to unauthorized access without proper\nauthentication. \u00a0 \n\n\n\n\n\n\n"}, {"lang": "es", "value": "En OpenEdge Authentication Gateway y AdminServer anteriores a 11.7.19, 12.2.14, 12.8.1 en todas las plataformas compatibles con el producto OpenEdge, se identific\u00f3 una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n. La vulnerabilidad es una omisi\u00f3n de la autenticaci\u00f3n basada en una falla al manejar adecuadamente el nombre de usuario y la contrase\u00f1a. Cierto contenido inesperado que se pasa a las credenciales puede provocar un acceso no autorizado sin la autenticaci\u00f3n adecuada."}], "lastModified": "2025-02-11T17:40:59.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "EE51C6DF-9ADA-4C9C-9820-94DD94ADA656", "versionEndExcluding": "11.7.19"}, {"criteria": "cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "6BD175A1-83AF-410B-9CEE-C9B65F32F3B4", "versionEndExcluding": "12.2.14", "versionStartIncluding": "11.8"}, {"criteria": "cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "D2D98FDE-6A77-4604-904C-43ABCE323D48", "versionEndExcluding": "12.8.1", "versionStartIncluding": "12.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}