CVE-2023-40051: Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40051?
CVE-2023-40051 is considered a critical vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2023-40051?
To fix CVE-2023-40051, upgrade to Progress Application Server for OpenEdge version 11.7.18 or higher, 12.2.13 or higher, or a version beyond 12.8.0.
What versions of Progress OpenEdge are affected by CVE-2023-40051?
CVE-2023-40051 affects Progress OpenEdge versions 11.7 before 11.7.18, 12.2 before 12.2.13, and all innovation releases prior to 12.8.0.
What type of attack is possible with CVE-2023-40051?
An attacker can exploit CVE-2023-40051 to formulate a request for a WEB transport allowing unintended file uploads to a server directory.
Is there a workaround for CVE-2023-40051 if I cannot upgrade?
Currently, there are no published workarounds for mitigating CVE-2023-40051 other than upgrading the affected software.