Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
Priority HIGH 82CWE-305Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03272 88th percentileScored 2026-11-07
Fix Fixed OpenEdge (Progress): 11.7.19, 12.2.14, 12.8.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progress | OpenEdge | 11.7.0 to before 11.7.19; 12.2.0 to before 12.2.14; 12.8.0 to before 12.8.1 | 11.7.19, 12.2.14, 12.8.1 | Patch available | CNA |
- OpenEdge VendorProgress Affected 11.7.0 to before 11.7.19; 12.2.0 to before 12.2.14; 12.8.0 to before 12.8.1 Fixed in 11.7.19, 12.2.14, 12.8.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:* | before 11.7.19; 11.8 to before 12.2.14; 12.3 to before 12.8.1 | Vulnerable | Progress |
- cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:* Versions before 11.7.19; 11.8 to before 12.2.14; 12.3 to before 12.8.1 Vulnerable ·Progress
Remediation
- Fix · CNA OpenEdge (Progress) Fixed in 11.7.19, 12.2.14, 12.8.1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1403
- 2026-10-03 Alias added: GHSA-m24w-wg7m-x27h
References
More Progress Openedge vulnerabilities
- TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
- TI-2015-07624 Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows… CVSS 3.0CRITICAL 9.8
- TI-2024-06806 Direct local client connections to MS Agents can bypass authentication CVSS 3.1CRITICAL 9.6
- TI-2023-20941 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal CVSS 3.1CRITICAL 9.9
- TI-2023-17041 In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a… CVSS 3.1HIGH 8.8
- TI-2023-20942 Progress Application Server (PAS) for OpenEdge Denial of Service CVSS 3.1HIGH 7.5
Sources
- CVE-2024-1403 · CVE Program
- CVE-2024-1403 · NVD
- FIRST EPSS
- GHSA-m24w-wg7m-x27h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences