CVE-2023-40051: fallo crítico en Progress Software Corporation OpenEdge
Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.6%
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Productos afectados
Progress Software Corporation · OpenEdgeCVEs relacionadas — Progress Software Corporation OpenEdge
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-7388HIGHAuthenticated Command Injection via configuration parameter manipulation in exposed RMI interfaceEPSS 1.0%CVE-2023-40052HIGHProgress Application Server (PAS) for OpenEdge Denial of ServiceEPSS 0.6%CVE-2025-7389HIGHUnauthorized Arbitrary File Read via RMI in AdminServer InterfaceEPSS 0.3%CVE-2025-8095CRITICALRecoverable obfuscation using the OECH1 prefix encoding in OpenEdgeEPSS 0.2%