CVE-2022-29849

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privilege escalation. If exploited, a local attacker could elevate their privileges and compromise the affected system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.progress.com/s/article/OpenEdge-11-7-14-is-Now-AvailablePatch, Release Notes, Vendor Advisory
https://community.progress.com/s/article/OpenEdge-12-2-9-Update-is-availablePatch, Vendor Advisory
https://community.progress.com/s/article/Remediation-of-Privilege-Escalation-Security-Vulnerability-CVE-2022-29849Mitigation, Vendor Advisory
https://www.progress.com/openedgeProduct
https://community.progress.com/s/article/OpenEdge-11-7-14-is-Now-AvailablePatch, Release Notes, Vendor Advisory
https://community.progress.com/s/article/OpenEdge-12-2-9-Update-is-availablePatch, Vendor Advisory
https://community.progress.com/s/article/Remediation-of-Privilege-Escalation-Security-Vulnerability-CVE-2022-29849Mitigation, Vendor Advisory
https://www.progress.com/openedgeProduct

Timeline

Published: May 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-29857.8In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional exec CVE-2022-298508.1Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence CVE-2022-298519.8documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file CVE-2022-298525.4OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.CVE-2022-298535.4OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.CVE-2022-298546.8A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated at CVE-2022-298556.8Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and CVE-2022-298567.5A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.CVE-2022-298584.3Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by chang CVE-2022-298599.8component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structures for DHCP packet d CVE-2022-29868.8Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.CVE-2022-298627.5An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.