CVE-2023-34203: In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL…

PriorityP352high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.06%

60.4th percentile

In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
progress	openedge	< 11.7.16	11.7.16
progress	openedge	>= 12.0 < 12.2.12	12.2.12
progress	openedge	>= 12.3 < 12.7	12.7
progress	openedge_explorer	< 12.7	12.7
progress	openedge_management	< 12.7	12.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.