Vulnerability Intelligence Report
Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
CVE-2024-1403
In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.
No Active Exploit Signals
CVSS Base Score
10.0
CRITICAL
Exploitability:3.9
Impact Score:6.1
EPSS Probability:3.27%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-305 ↗CWE-305: Authentication Bypass by Primary Weakness
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Progress | OpenEdge | 11.7.0 < 11.7.19 (affected), 12.2.0 < 12.2.14 (affected), 12.8.0 < 12.8.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
3.272%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Progress Software Corporation · Vendor · USA |
| Reserved | 2024-02-09T15:46:27 |
| Published | 2024-02-27T15:39:54 |
| Last Updated | 2024-08-12T19:27:43 |
Community Chatter & Buzz