Potential Code Injection Vulnerability in Multi-Session Agents on ABL Platforms
CVE-2024-7345

9.6CRITICAL

Key Information:

Vendor
Progress
Status
Openedge
Vendor
CVE Published:
3 September 2024

Summary

A security flaw exists within the OpenEdge environment that allows local ABL Clients to bypass necessary PASOE security checks. This vulnerability potentially enables attackers to inject unauthorized code into Multi-Session Agents, affecting supported OpenEdge Long-Term Support (LTS) platforms. This issue is present in versions up to OpenEdge LTS 11.7.18 and LTS 12.2.13 across all supported release platforms, posing a significant risk to the integrity of applications running within these environments.

Affected Version(s)

OpenEdge Windows 11.7.0 <= 11.7.19

OpenEdge Windows 11.7.0 <= 11.7.19

OpenEdge Windows 12.2.0 <= 12.2.14

References

https://community.progress.com/s/article/Direct-local-cli...
vendor-advisory

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.