Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2023-40051

Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ProgressSoftware

Description

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Progress Software Corporation OpenEdge

Default version status: affected

  • 11.7.0 to < 11.7.18affected
  • 12.2.0 to < 12.2.13affected
  • Innovation Releases to < 12.8.0affected

References