CVE-2024-1403 | In OpenEdge Authentication Gateway and AdminServer prior to … | CVSS 10.0 CRITICAL

Description

In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.

Metadata

CVE ID: CVE-2024-1403
State: PUBLISHED
Assigner: ProgressSoftware
Reserved: 2024-02-09 15:46 UTC
Published: 2024-02-27 15:39 UTC
Last updated: 2024-08-12 19:27 UTC
Primary CWE: CWE-305
CWE-305: Authentication Bypass by Primary Weakness
Vendor / Product: Progress / OpenEdge
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Progress	OpenEdge	Windows,Linux,x86,64 bit,32 bit	11.7.0 < 11.7.19, 12.2.0 < 12.2.14, 12.8.0 < 12.8.1

Weakness (CWE)

CWE	Source	Description
CWE-305	cna	CWE-305: Authentication Bypass by Primary Weakness

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)