Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows…
Priority MEDIUM 46CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.
Why it matters now
EPSS 0.01856 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:progress:openedge:10.2a:*:*:*:*:*:*:* | 10.2a | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:10.2b:*:*:*:*:*:*:* | 10.2b | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:10.2b07:*:*:*:*:*:*:* | 10.2b07 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:10.2b08:*:*:*:*:*:*:* | 10.2b08 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:11.1:*:*:*:*:*:*:* | 11.1 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:11.2:*:*:*:*:*:*:* | 11.2 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:11.3:*:*:*:*:*:*:* | 11.3 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:11.4:*:*:*:*:*:*:* | 11.4 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge:11.5:*:*:*:*:*:*:* | 11.5 | Vulnerable | Progress |
- cpe:2.3:a:progress:openedge:10.2a:*:*:*:*:*:*:* Versions 10.2a Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:10.2b:*:*:*:*:*:*:* Versions 10.2b Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:10.2b07:*:*:*:*:*:*:* Versions 10.2b07 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:10.2b08:*:*:*:*:*:*:* Versions 10.2b08 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:11.2:*:*:*:*:*:*:* Versions 11.2 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:11.3:*:*:*:*:*:*:* Versions 11.3 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:11.4:*:*:*:*:*:*:* Versions 11.4 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge:11.5:*:*:*:*:*:*:* Versions 11.5 Vulnerable ·Progress
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-9245
- 2026-10-03 Alias added: GHSA-m529-fwhc-gw26
References
More Progress Openedge vulnerabilities
- TI-2024-01310 Authentication Bypass in OpenEdge Authentication Gateway and AdminServer CVSS 3.1CRITICAL 10.0
- TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
- TI-2024-06806 Direct local client connections to MS Agents can bypass authentication CVSS 3.1CRITICAL 9.6
- TI-2023-20941 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal CVSS 3.1CRITICAL 9.9
- TI-2023-17041 In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a… CVSS 3.1HIGH 8.8
- TI-2023-20942 Progress Application Server (PAS) for OpenEdge Denial of Service CVSS 3.1HIGH 7.5
Sources
- CVE-2015-9245 · CVE Program
- CVE-2015-9245 · NVD
- FIRST EPSS
- GHSA-m529-fwhc-gw26 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences