CVE-2023-40051

An attacker crafts a specially prepared request to the WEB transport handled by PASOE, which enables uncontrolled file upload to any directory path on the server. The file validation mechanism is insufficient (CWE-434: Unrestricted Upload of File with Dangerous Type), allowing placement of a file containing a malicious payload on the server. If the uploaded file can then be executed or processed by the server or other network components, it is possible to escalate the attack.

An attacker can upload a malicious file to the server, which may lead to further system or network compromise, including potential code execution, data integrity violation, and escalation to an attack on broader infrastructure.

Progress Application Server for OpenEdge should be updated to version 11.7.18 or later (for the 11.7 branch), 12.2.13 or later (for the 12.2 branch), or 12.8.0 or later (for innovation releases). Detailed instructions are available in the vendor's official security advisory at the address indicated in the references.

Progress Application Server (PAS) for OpenEdge in versions 11.7 before 11.7.18, 12.2 before 12.2.13, and innovation releases before 12.8.0