CVE-2023-34203

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.

*Credits: N/A

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-05-30 CVE Reserved
2023-06-23 CVE Published
2024-06-29 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CAPEC

References (1)

URL	Tag	Source
https://www.progress.com/openedge	Product

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Progress Search vendor "Progress"		Openedge Search vendor "Progress" for product "Openedge"				< 11.7.16 Search vendor "Progress" for product "Openedge" and version " < 11.7.16"		lts		Affected
Progress Search vendor "Progress"		Openedge Search vendor "Progress" for product "Openedge"				>= 12.0 < 12.2.12 Search vendor "Progress" for product "Openedge" and version " >= 12.0 < 12.2.12"		lts		Affected
Progress Search vendor "Progress"		Openedge Search vendor "Progress" for product "Openedge"				>= 12.3 < 12.7 Search vendor "Progress" for product "Openedge" and version " >= 12.3 < 12.7"		lts		Affected
Progress Search vendor "Progress"		Openedge Explorer Search vendor "Progress" for product "Openedge Explorer"				< 12.7 Search vendor "Progress" for product "Openedge Explorer" and version " < 12.7"		-		Affected
Progress Search vendor "Progress"		Openedge Management Search vendor "Progress" for product "Openedge Management"				< 12.7 Search vendor "Progress" for product "Openedge Management" and version " < 12.7"		-		Affected