CVE-2024-7346: progress openedge
Vulnerability summary
CVE-2024-7346 is a high (CVSS 7.2) vulnerability in progress openedge. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.9% of scored vulnerabilities.
Timeline
- 03-09-2024PublishedVulnerability first disclosed.
- 03-09-2024Last modifiedVulnerability information updated.
Description
Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security. The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
0.00 pp
From 0.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-297Improper Validation of Certificate with Host MismatchThe product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Progress1 product
- openedge≥ 11.7.0, ≤ 11.7.19 | ≥ 12.2.0, ≤ 12.2.14 | ≤ 11.7.19 | ≥ 12.0, ≤ 12.2.14
1 vendor · 1 product