CVE-2023-40051

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Progress Software Corporation	OpenEdge	>= 11.7.0, < 11.7.18; >= 12.2.0, < 12.2.13; >= Innovation Releases, < 12.8.0

References

Timeline

Published: Jan 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-400527.5This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation r CVE-2023-400535.0A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function featu CVE-2023-400548.8The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a CVE-2023-400558.8The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a CVE-2023-400568.8SQL Injection Remote Code Vulnerability was found in the SolarWinds Platform. This vulnerability can be exploited with a low privileged acco CVE-2023-400579.0The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability CVE-2023-400586.5Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager CVE-2023-40069.8Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.CVE-2023-400607.2A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-fact CVE-2023-400618.8Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result.CVE-2023-400628.8SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a CVE-2023-400675.7Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege vi