CVE-2023-34203: progress openedge Injection

Vulnerability summary

CVE-2023-34203 is a high (CVSS 8.8) Injection vulnerability in progress openedge. EPSS estimates a 1.06% chance of exploitation in the next 30 days, higher than 64.1% of scored vulnerabilities.

Timeline

1. 23-06-2023
   PublishedVulnerability first disclosed.
2. 02-12-2024
   Last modifiedVulnerability information updated.

Description

In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.