Progress OpenEdge up to 12.2.9/12.2.18 AdminServer setFile/openFile file access

Summaryinfo

A vulnerability classified as problematic was found in Progress OpenEdge up to 12.2.9/12.2.18. The affected element is the function setFile/openFile of the component AdminServer. Such manipulation leads to file access. This vulnerability is listed as CVE-2025-7389. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Progress OpenEdge up to 12.2.9/12.2.18. It has been rated as problematic. Affected by this issue is the function setFile/openFile of the component AdminServer. The manipulation with an unknown input leads to a file access vulnerability. Using CWE to declare the problem leads to CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be. Impacted is confidentiality. CVE summarizes:

A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself.  The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile() methods exposed through the RMI interface.  Misuse was limited only by OS-level authority of the AdminServer's elevated privileges granted and the user's access to these methods enabled through RMI.  The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.

The weakness was presented by Thomas Riedmaier. The advisory is shared for download at community.progress.com. This vulnerability is handled as CVE-2025-7389 since 07/09/2025. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/14/2026). The MITRE ATT&CK project declares the attack technique as T1083.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Progress

Name

• OpenEdge

Version

• 12.2.0
• 12.2.1
• 12.2.2
• 12.2.3
• 12.2.4
• 12.2.5
• 12.2.6
• 12.2.7
• 12.2.8
• 12.2.9
• 12.2.10
• 12.2.11
• 12.2.12
• 12.2.13
• 12.2.14
• 12.2.15
• 12.2.16
• 12.2.17
• 12.2.18

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion