High severity · published Jan 18, 2024
CVE-2023-40052
Progress Application Server (PAS) for OpenEdge Denial of Service
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0
.
An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenEdge · Progress Software Corporation
11.7.0 before 11.7.18; 12.2.0 before 12.2.13; Innovation Releases before 12.8.0 · source: vendor, NVD, CISA
OI
Openedge Innovation · Progress
before 12.8.0 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-40052
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-40052
Vendor Advisory
https://community.progress.com/s/article/Important-Progress-OpenEdge-Product-Alert-for-Progress-Application-Server-for-OpenEdge-PASOE-Denial-of-Service-Vulnerability-in-WEB-Transport
Product
https://www.progress.com/openedge
More from OpenEdge
9.9
CVE-2023-40051
Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
9.1
CVE-2025-8095
Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
8.4
CVE-2025-7388
Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface
8.2
CVE-2025-7389
Unauthorized Arbitrary File Read via RMI in AdminServer Interface