CVE-2024-7345 HIGH

CVE-2024-7345: Direct local client connections to MS Agents can bypass authentication

Vendor Progress
Product OpenEdge
Weakness CWE-94 · Code injection
Published September 3, 2024
Last update September 3, 2024
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms

Key dates

02Disclosure timeline

September 3, 2024 CVE published
September 3, 2024 Record updated