CVE-2023-40051: critical vulnerability in Progress Software Corporation OpenEdge
Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 0.6%
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Affected products
Progress Software Corporation · OpenEdgeRelated CVEs — Progress Software Corporation OpenEdge
In the same product, most dangerous first.
CVE-2025-7388HIGHAuthenticated Command Injection via configuration parameter manipulation in exposed RMI interfaceEPSS 1.0%CVE-2023-40052HIGHProgress Application Server (PAS) for OpenEdge Denial of ServiceEPSS 0.6%CVE-2025-7389HIGHUnauthorized Arbitrary File Read via RMI in AdminServer InterfaceEPSS 0.3%CVE-2025-8095CRITICALRecoverable obfuscation using the OECH1 prefix encoding in OpenEdgeEPSS 0.2%