Riskcovery

CVE-2023-40052

Progress Application Server (PAS) for OpenEdge Denial of Service

State
Published
Severity
7.5 High
Published
Jan 18, 2024
Updated
Aug 29, 2024
Reserved
Aug 8, 2023

Read the record on cve.org

Description

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0

.

An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HProgressSoftware

Weaknesses

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected Products

ProductVersions
OpenEdgeProgress Software Corporation
  • 11.7.0 to before 11.7.18Affected
  • 12.2.0 to before 12.2.13Affected
  • Innovation Releases to before 12.8.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.