Progress OpenEdge up to 11.7.18/12.2.13/12.8.0 authentication bypass

Summaryinfo

A vulnerability was found in Progress OpenEdge up to 11.7.18/12.2.13/12.8.0. It has been declared as very critical. Affected by this issue is some unknown functionality. The manipulation results in authentication bypass. This vulnerability is cataloged as CVE-2024-1403. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Progress OpenEdge up to 11.7.18/12.2.13/12.8.0. It has been classified as very critical. Affected is some unknown processing. The manipulation with an unknown input leads to a authentication bypass vulnerability. CWE is classifying the issue as CWE-305. The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.  The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.  

The weakness was shared 02/27/2024. The advisory is shared for download at community.progress.com. This vulnerability is traded as CVE-2024-1403 since 02/09/2024. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/12/2025).

Upgrading to version 11.7.19, 12.2.14 or 12.8.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Progress

Name

• OpenEdge

Version

• 11.7.0
• 11.7.1
• 11.7.2
• 11.7.3
• 11.7.4
• 11.7.5
• 11.7.6
• 11.7.7
• 11.7.8
• 11.7.9
• 11.7.10
• 11.7.11
• 11.7.12
• 11.7.13
• 11.7.14
• 11.7.15
• 11.7.16
• 11.7.17
• 11.7.18
• 12.0
• 12.1
• 12.2
• 12.2.0
• 12.2.1
• 12.2.2
• 12.2.3
• 12.2.4
• 12.2.5
• 12.2.6
• 12.2.7
• 12.2.8
• 12.2.9
• 12.2.10
• 12.2.11
• 12.2.12
• 12.2.13
• 12.3
• 12.4
• 12.5
• 12.6
• 12.7
• 12.8.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion