CVE-2024-7345 - Direct local client connections to MS Agents can bypass authentication

Back Back to CVE browser

CRITICAL

Direct local client connections to MS Agents can bypass authentication

Published Sep 3, 2024

9.6

CRITICAL

CVSS 3.1

EPSS 0.59%

Description

Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms

Affected products

Vendor Progress Product OpenEdge Default
affected
- Version
  11.7.0
  Status
  affected
  Constraints
  <=11.7.19
- Version
  12.2.0
  Status
  affected
  Constraints
  <=12.2.14
- Version
  12.8.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress

OpenEdge

affected

Version	Status	Constraints
11.7.0	affected	<=11.7.19
12.2.0	affected	<=12.2.14
12.8.0	unaffected	-

Vendor Progress Product Openedge Default
affected
- Version
  11.7.0
  Status
  affected
  Constraints
  <=11.7.19
- Version
  12.2.0
  Status
  affected
  Constraints
  <=12.2.14
- Version
  12.8.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress

Openedge

affected

Version	Status	Constraints
11.7.0	affected	<=11.7.19
12.2.0	affected	<=12.2.14
12.8.0	unaffected	-

Remediation

Vendor solution

Use the 12.8.0 or above LTS release where the vulnerability does not exist

Use the 12.2 LTS release at the 12.2.14 Update level or above

Use the 11.7 LTS release at the 11.7.19 Update level or above

Weaknesses (1)

CWE-94

Code Injection

References (2)

https://community.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication
vendor-advisoryMitigationVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48283
Advisory

Link	Providers	Tags
https://community.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication		vendor-advisoryMitigationVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48283		Advisory