Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2024-7345

Direct local client connections to MS Agents can bypass authentication

Description

Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms

Timeline

  1. ID reserved

    By ProgressSoftware

  2. · 34 days later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-7345, by who scored it
Scored byCVSSScoreVector
ProgressSoftwareCNA (assigner)3.1High8.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Analyzed3.1Critical9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.59% · top 51% of all CVEs (11 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.

Affected products

  • Progress · OpenEdge

    • affected 11.7.0 – ≤ 11.7.19
    • affected 12.2.0 – ≤ 12.2.14
    • unaffected 12.8.0

What to do

Solution: Use the 12.8.0 or above LTS release where the vulnerability does not exist

Solution: Use the 12.2 LTS release at the 12.2.14 Update level or above

Solution: Use the 11.7 LTS release at the 11.7.19 Update level or above

Workaround: Do not put client software on host webserver systems

Workaround: Ensure the "AppServer.SessMgr.agentHost" property is set to "localhost" unless you are multi-hosting a single Webserver system

Workaround: Block agent listening ports from network access anywhere with the exception of the PASOE Tomcat Webserver's published listening port

Workaround: Launch PASOE agent processes with "least privilege" system resource capabilities

References

References1

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-7345 badge
[![CVE-2024-7345](https://cveledger.app/badge/CVE-2024-7345.svg)](https://cveledger.app/cve/CVE-2024-7345)

Record last updated .