VULNERABILITY INTELLIGENCE

CVE-2023-40051

CVSS score9.1 CRITICAL
EPSS probability0.56%
CISA KEVNot currently listed
Published2024-01-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Description

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

Weakness classification

  • security@progress.com: CWE-434
  • nvd@nist.gov: CWE-434

Primary references