CVE-2023-40051

Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal

State: Published
Severity: 9.1 Critical
Published: Jan 18, 2024
Updated: Jun 2, 2025
Reserved: Aug 8, 2023

Description

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L	ProgressSoftware

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
OpenEdgeProgress Software Corporation	11.7.0 to before 11.7.18Affected 12.2.0 to before 12.2.13Affected Innovation Releases to before 12.8.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.