Read the docs
TI-2024-06807 Aliases CVE-2024-7346GHSA-jw9p-3gc4-84rw

Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation

Priority LOW 37CWE-297Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.  This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.  The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix Fixed OpenEdge (Progress): 12.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressOpenEdge11.7.0 – 11.7.19; 12.2.0 – 12.2.1412.8.0Patch availableCNA
  • OpenEdge VendorProgress Affected 11.7.0 – 11.7.19; 12.2.0 – 12.2.14 Fixed in 12.8.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*up to 11.7.19VulnerableProgress
cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:*12.0 – 12.2.14VulnerableProgress
  • cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:* Versions up to 11.7.19 Vulnerable ·Progress
  • cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:* Versions 12.0 – 12.2.14 Vulnerable ·Progress

Remediation

  • Fix · CNA OpenEdge (Progress) Fixed in 12.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7346
  2. 2026-10-03 Alias added: GHSA-jw9p-3gc4-84rw

References

Advisory 1

  • TI-2024-01310 Authentication Bypass in OpenEdge Authentication Gateway and AdminServer CVSS 3.1CRITICAL 10.0
  • TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
  • TI-2015-07624 Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows… CVSS 3.0CRITICAL 9.8
  • TI-2024-06806 Direct local client connections to MS Agents can bypass authentication CVSS 3.1CRITICAL 9.6
  • TI-2023-20941 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal CVSS 3.1CRITICAL 9.9
  • TI-2023-17041 In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a… CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences