CVE-2024-1403: Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
First published: Tue Feb 27 2024(Updated: )
In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.
Credit: security@progress.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Progress OpenEdge Explorer | <11.7.19 | |
| Progress OpenEdge Explorer | >=11.8<12.2.14 | |
| Progress OpenEdge Explorer | >=12.3<12.8.1 | |
| Progress OpenEdge Authentication Gateway | <11.7.19 | |
| Progress | <11.7.19 | |
| Progress OpenEdge Authentication Gateway | <12.2.14 | |
| Progress | <12.2.14 | |
| Progress OpenEdge Authentication Gateway | <12.8.1 | |
| Progress | <12.8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1403?
CVE-2024-1403 has been identified as an authentication bypass vulnerability, which can lead to unauthorized access.
How do I fix CVE-2024-1403?
To remediate CVE-2024-1403, update OpenEdge Authentication Gateway and AdminServer to versions 11.7.19, 12.2.14, or 12.8.1 or later.
Which versions of Progress OpenEdge are affected by CVE-2024-1403?
CVE-2024-1403 impacts all versions of Progress OpenEdge prior to 11.7.19, as well as versions between 11.8 and 12.2.14 and versions between 12.3 and 12.8.1.
What are the potential impacts of CVE-2024-1403?
Exploitation of CVE-2024-1403 can allow attackers to bypass authentication mechanisms, leading to unauthorized access to sensitive systems.
Is CVE-2024-1403 common across all OpenEdge products?
CVE-2024-1403 affects both OpenEdge Authentication Gateway and AdminServer on all supported platforms.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- vendor/progress
- canonical/progress openedge explorer
- version/progress openedge explorer/11.8
- version/progress openedge explorer/12.3
- canonical/progress openedge authentication gateway
- canonical/progress