In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a…
Priority MEDIUM 42CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01064 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:* | before 11.7.16; 12.0 to before 12.2.12; 12.3 to before 12.7 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge_explorer:*:*:*:*:*:*:*:* | before 12.7 | Vulnerable | Progress |
| cpe:2.3:a:progress:openedge_management:*:*:*:*:*:*:*:* | before 12.7 | Vulnerable | Progress |
- cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:* Versions before 11.7.16; 12.0 to before 12.2.12; 12.3 to before 12.7 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge_explorer:*:*:*:*:*:*:*:* Versions before 12.7 Vulnerable ·Progress
- cpe:2.3:a:progress:openedge_management:*:*:*:*:*:*:*:* Versions before 12.7 Vulnerable ·Progress
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34203
- 2026-10-03 Alias added: GHSA-4m7m-xch5-73g6
References
More Progress Openedge vulnerabilities
- TI-2024-01310 Authentication Bypass in OpenEdge Authentication Gateway and AdminServer CVSS 3.1CRITICAL 10.0
- TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
- TI-2015-07624 Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows… CVSS 3.0CRITICAL 9.8
- TI-2024-06806 Direct local client connections to MS Agents can bypass authentication CVSS 3.1CRITICAL 9.6
- TI-2023-20941 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal CVSS 3.1CRITICAL 9.9
- TI-2023-20942 Progress Application Server (PAS) for OpenEdge Denial of Service CVSS 3.1HIGH 7.5
Sources
- CVE-2023-34203 · CVE Program
- CVE-2023-34203 · NVD
- FIRST EPSS
- GHSA-4m7m-xch5-73g6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences