Read the docs
TI-2024-07093 Aliases CVE-2024-7654GHSA-fgc8-q46c-35v5

Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated.  Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other types of attack that could spoof or deceive web interface users.   Unauthorized use of the OEE/OEM discovery service was remediated by deactivating the discovery service by default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00294 22nd percentileScored 2026-11-07
Fix Fixed OpenEdge (Progress): 11.7.19, 12.2.15, 12.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressOpenEdge11.7.0 to before 11.7.19; 12.2.0 to before 12.2.15; 12.8.0 to before 12.8.211.7.19, 12.2.15, 12.8.2Patch availableCNA
  • OpenEdge VendorProgress Affected 11.7.0 to before 11.7.19; 12.2.0 to before 12.2.15; 12.8.0 to before 12.8.2 Fixed in 11.7.19, 12.2.15, 12.8.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*up to 11.7.19VulnerableProgress
cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:*12.2 – 12.2.14; 12.8 to before 12.8.3VulnerableProgress
  • cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:* Versions up to 11.7.19 Vulnerable ·Progress
  • cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:* Versions 12.2 – 12.2.14; 12.8 to before 12.8.3 Vulnerable ·Progress

Remediation

  • Fix · CNA OpenEdge (Progress) Fixed in 11.7.19, 12.2.15, 12.8.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7654
  2. 2026-10-03 Alias added: GHSA-fgc8-q46c-35v5

References

Advisory 1

  • TI-2024-01310 Authentication Bypass in OpenEdge Authentication Gateway and AdminServer CVSS 3.1CRITICAL 10.0
  • TI-2007-02334 Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and… CVSS 2.0HIGH 10.0
  • TI-2015-07624 Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows… CVSS 3.0CRITICAL 9.8
  • TI-2024-06806 Direct local client connections to MS Agents can bypass authentication CVSS 3.1CRITICAL 9.6
  • TI-2023-20941 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal CVSS 3.1CRITICAL 9.9
  • TI-2023-17041 In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a… CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences