QID 150819

Date Published: 2024-03-06

QID 150819: Progress OpenEdge Authentication Gateway Authentication Bypass Vulnerability (CVE-2024-1403)

OpenEdge Advanced Business Language, or OpenEdge ABL for short, is a business application development language created and maintained by Progress Software Corporation.

When the OpenEdge Authentication Gateway (OEAG) is configured with an OpenEdge Domain that uses the OS local authentication provider to grant user-id and password logins on operating platforms supported by active releases of OpenEdge, a vulnerability in the authentication routines may lead to unauthorized access on attempted logins.
Similarly, when an AdminServer connection is made by OpenEdge Explorer (OEE) and OpenEdge Management (OEM), it also utilizes the OS local authentication provider on supported platforms to grant user-id and password logins that may also lead to unauthorized login access.

Affected versions:
OpenEdge Release 11.7.18 and earlier
OpenEdge 12.2.13 and earlier
OpenEdge 12.8.0

QID Detection Logic (Unauthenticated):
This QID sends a HTTP GET request and checks for vulnerable version of OpenEdge running on the target application.

Successful exploitation of this vulnerability could allow a remote attacker to access restricted resources by bypassing control checks.

CVSS V3 rated as Critical - 10 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

Customers are advised to refer OpenEdge for information pertaining to remediating this vulnerability.

Vendor References

OpenEdge - community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer

CVEs related to QID 150819

CVE-2024-1403 |

Software Advisories

Advisory ID	Software	Component	Link
OpenEdge			community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].