CVE-2023-40051
Assigner: ProgressSoftware
Published: 2024-01-18T15:11:04.080Z
State: PUBLISHED
affected: defaultStatus: affected
modules: Progress Application Server (PAS) for OpenEdge
product: OpenEdge
vendor: Progress Software Corporation
versions: lessThan: 11.7.18
status: affected
version: 11.7.0
versionType: semver
lessThan: 12.2.13
status: affected
version: 12.2.0
versionType: semver
lessThan: 12.8.0
status: affected
version: Innovation Releases
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: <p>This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0.&nbsp;An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

</p>
value: This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.




impacts: capecId: CAPEC-17
descriptions: value: CAPEC-17 Using Malicious Files
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
type: CWE
source: discovery: UNKNOWN
title: Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
x_generator: engine: Vulnogram 0.1.0-dev