Unauthorized Access Vulnerability in OpenEdge Authentication Gateway and AdminServer Prior to 11.7.19, 12.2.14, and 12.8.1
CVE-2024-1403

9.8CRITICAL

Key Information:

Vendor
Progress
Status
Openedge
Vendor
CVE Published:
27 February 2024

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC📰 News Worthy

Summary

There is a critical unauthorized access vulnerability in the OpenEdge Authentication Gateway and AdminServer prior to specific versions, allowing attackers to bypass authentication and gain unauthorized access to the system. The vulnerability can potentially allow access with administrative privileges. A proof-of-concept exploit for this vulnerability has been released. The impact of this vulnerability is severe and can result in unauthorized access, system compromise, and potential spread of malware. It is advised for organizations to upgrade to the patched version to mitigate the risk.

Affected Version(s)

OpenEdge Windows 11.7.0

OpenEdge Windows 11.7.0 < 11.7.19

OpenEdge Windows 12.2.0 < 12.2.14

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-1403
Created by horizon3ai

News Articles

favicon imageSmarter MSP

Cybersecurity Threat Advisory: OpenEdge authentication bypass vulnerability

Review this Cybersecurity Threat Advisory to learn how you can mitigate potential unauthorized access due to the OpenEdge vulnerability.

favicon imageSecurity Affairs

Experts released PoC exploit for critical Progress Software OpenEdge bug

Researchers released technical specifics and a PoC for a flaw in Progress Software OpenEdge Authentication Gateway and AdminServer

favicon imageSecurity Affairs

CVE-2024-1403 Progress OpenEdge Authentication Bypass - Security Affairs

Insurance scams via QR codes: how to recognise and defend yourself  |  Massive cyberattacks hit French government agencies  |  BianLian group exploits JetBrains TeamCity bugs in ransomware attacks  |  Experts...

References

https://www.progress.com/openedge
product
https://community.progress.com/s/article/Important-Critic...
vendor-advisory

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 📰

    First article discovered by The Hacker News

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.