TI-2023-20942 Aliases CVE-2023-40052 GHSA-559p-m25r-rqhm

Progress Application Server (PAS) for OpenEdge Denial of Service

MEDIUM 40CWE-119Published 2024-01-18 · Updated 2024-08-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 . An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0057 47th percentileScored 2026-11-07

Fix Fixed OpenEdge (Progress Software Corporation): 11.7.18, 12.2.13, 12.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Progress	OpenEdge	11.7.0 to before 11.7.18; 12.2.0 to before 12.2.13; Innovation Releases to before 12.8.0	11.7.18, 12.2.13, 12.8.0	Patch available	CNA

OpenEdge VendorProgress Affected 11.7.0 to before 11.7.18; 12.2.0 to before 12.2.13; Innovation Releases to before 12.8.0 Fixed in 11.7.18, 12.2.13, 12.8.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:progress:openedge::::::::	11.7 to before 11.7.18; 12.2 to before 12.2.13	Vulnerable	Progress
cpe:2.3:a:progress:openedge_innovation::::::::	before 12.8.0	Vulnerable	Progress

cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:* Versions 11.7 to before 11.7.18; 12.2 to before 12.2.13 Vulnerable ·Progress
cpe:2.3:a:progress:openedge_innovation:*:*:*:*:*:*:*:* Versions before 12.8.0 Vulnerable ·Progress

Remediation

Fix · CNA OpenEdge (Progress Software Corporation) Fixed in 11.7.18, 12.2.13, 12.8.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-01-18
Progress Software OpenEdge 11.7.18, 12.2.13, 12.8.0
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-20941 Progress Application Server (PAS) for OpenEdge File Upload via Directory TraversalPriority MEDIUM 43
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-40052
2026-10-03 Alias added: GHSA-559p-m25r-rqhm

References

Advisory 1

https://community.progress.com/s/article/Important-Progress-OpenEdge-Product-Alert-for-Progress-Application-Server-for-OpenEdge-PASOE-Denial-of-Service-Vulnerability-in-WEB-Transport

Other 1

https://www.progress.com/openedge

TI-2024-01310 Authentication Bypass in OpenEdge Authentication Gateway and AdminServer CVSS 3.1CRITICAL 10.0
TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
TI-2015-07624 Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows… CVSS 3.0CRITICAL 9.8
TI-2024-06806 Direct local client connections to MS Agents can bypass authentication CVSS 3.1CRITICAL 9.6
TI-2023-20941 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal CVSS 3.1CRITICAL 9.9
TI-2023-17041 In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a… CVSS 3.1HIGH 8.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences