CVE-2025-7389: fallo de gravedad alta en Progress Software Corporation OpenEdge
Unauthorized Arbitrary File Read via RMI in AdminServer Interface
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.3%
A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server
through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile()
methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated
privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Productos afectados
Progress Software Corporation · OpenEdgeCVEs relacionadas — Progress Software Corporation OpenEdge
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-7388HIGHAuthenticated Command Injection via configuration parameter manipulation in exposed RMI interfaceEPSS 1.0%CVE-2023-40052HIGHProgress Application Server (PAS) for OpenEdge Denial of ServiceEPSS 0.6%CVE-2023-40051CRITICALProgress Application Server (PAS) for OpenEdge File Upload via Directory TraversalEPSS 0.6%CVE-2025-8095CRITICALRecoverable obfuscation using the OECH1 prefix encoding in OpenEdgeEPSS 0.2%