CVE-2023-40051CWE-434

Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal

Critical ยท published January 18, 2024

CVSS v3.1
9.1
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

๐Ÿ”ฅ A crafty attacker can slip a payload into your Progress Application Server, opening the door for a catastrophic breach! Think of this vulnerability like an unchecked delivery driver who drops off suspicious packages at your office โ€” if nobody checks the contents, you could end up with a ticking time bomb in your server room! ๐Ÿข๐Ÿ“ฆ This vulnerability allows attackers to upload malicious files directly to your server, potentially leading to a full-blown security disaster. If exploited, they may launch a larger-scale attack on your network, compromising sensitive data and disrupting operations โ€” absolutely devastating!

Put simply

Think of this vulnerability like an unchecked delivery driver who drops off suspicious packages at your office โ€” if nobody checks the contents, you could end up with a ticking time bomb in your server room! ๐Ÿข๐Ÿ“ฆ The vulnerability affects Progress Application Server (PAS) for OpenEdge, allowing attackers to formulate requests that lead to unintended file uploads. By uploading a malicious payload to a server directory, they can further exploit the server or its network.

What to do

This vulnerability allows attackers to upload malicious files directly to your server, potentially leading to a full-blown security disaster. If exploited, they may launch a larger-scale attack on your network, compromising sensitive data and disrupting operations โ€” absolutely devastating! To protect your systems, immediately patch to versions 11.7.18, 12.2.13, or 12.8.0 as appropriate. Additionally, review your server configurations and implement strict checks on file uploads to prevent unauthorized access. ๐Ÿ›ก๏ธ You've got this! Take action now, and you'll secure your server against this threat in no time! ๐Ÿ’ชโœจ

The record
Technical detail
CVSS v3.1
9.1 ยท CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00557 ยท 45.7th percentile
Weakness
CWE-434 ยท Unrestricted Upload of File with Dangerous Type
Published
2024-01-18T15:11Z
EPSS history
Timeline
  • 18 JAN 15:11Z
    Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
    cvelistv5