{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-09T15:51:25.912","vulnerabilities":[{"cve":{"id":"CVE-2023-40051","sourceIdentifier":"security@progress.com","published":"2024-01-18T15:15:09.060","lastModified":"2024-11-21T08:18:36.410","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.\n\n\n\n"},{"lang":"es","value":"Este problema afecta a Progress Application Server (PAS) para OpenEdge en las versiones 11.7 anteriores a 11.7.18, 12.2 anteriores a 12.2.13 y versiones de innovación anteriores a 12.8.0. Un atacante puede formular una solicitud para un transporte WEB que permita cargas de archivos no deseadas a una ruta de directorio del servidor en el sistema que ejecuta PASOE. Si la carga contiene un payload que puede explotar aún más el servidor o su red, es posible que se lance un ataque a mayor escala."}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":5.3},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*","versionStartIncluding":"11.7","versionEndExcluding":"11.7.18","matchCriteriaId":"7298E8E1-4C6A-4AE7-954E-480F86D8B8E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*","versionStartIncluding":"12.2","versionEndExcluding":"12.2.13","matchCriteriaId":"2057ECB7-5DD8-485F-9D43-560A152C883C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:progress:openedge_innovation:*:*:*:*:*:*:*:*","versionEndExcluding":"12.8.0","matchCriteriaId":"59216BF0-5044-4252-AB97-B63FFAA84F24"}]}]}],"references":[{"url":"https://community.progress.com/s/article/Important-Progress-OpenEdge-Critical-Alert-for-Progress-Application-Server-in-OpenEdge-PASOE-Arbitrary-File-Upload-Vulnerability-in-WEB-Transport","source":"security@progress.com","tags":["Vendor Advisory"]},{"url":"https://www.progress.com/openedge","source":"security@progress.com","tags":["Product"]},{"url":"https://community.progress.com/s/article/Important-Progress-OpenEdge-Critical-Alert-for-Progress-Application-Server-in-OpenEdge-PASOE-Arbitrary-File-Upload-Vulnerability-in-WEB-Transport","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.progress.com/openedge","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]}]}}]}