The Progress OpenEdge team recently discovered a security vulnerability in OpenEdge 11.7.15, OpenEdge 12.2.11, and in OpenEdge 12.6. We have addressed the issue and updated the product for customers to remediate it. 
 

Please carefully read this notification. It provides a brief description of the security vulnerability, potential impact and important links to Update details and additional information. 

If you are running OpenEdge 11.7.15 or earlier, please apply the Update, OpenEdge 11.7.16 or later. If you are running OpenEdge 12.2.11 or earlier, please apply the Update, OpenEdge 12.2.12 or later. If you are running OpenEdge 12.6 or earlier, please upgrade to OpenEdge 12.7. 
 

• If your OpenEdge version is in the Retired Life Cycle Phase as described in the OpenEdge Life Cycle, you may also be vulnerable and should upgrade to an Active version where Updates are available. 

Security Issue and Potential Impact: 

Please review the public information associated with this security vulnerability provided by the National Vulnerability Database located at CVE-2023-34203 (Discoverer Credit: HackerOne - g3n3).  

Using a local or remote admin service, a logged-in OpenEdge Management (OEM) or OpenEdge Explorer (OEE) user could perform a URL injection attack to change identity or role membership.  Only users that are already authorized members of OEM or OEE user roles were able to perform this exploit.  Non-admin role members were able to obtain unauthorized escalation to admin role privileges where unrestricted OEM and OEE capabilities were available to the user. 

Resolution: 

Patches for supported OpenEdge releases should be applied:
 

Vulnerable Version	Fixed Version	Documentation
OpenEdge LTS Update 11.7.15 and earlier	OpenEdge LTS Update 11.7.16	https://docs.progress.com/category/openedge-information-hub
OpenEdge LTS Update 12.2.11 and earlier	OpenEdge LTS Update 12.2.12
OpenEdge 12.6 and earlier	OpenEdge 12.7

 

How to Upgrade: 
 

Click here for instructions on how to download your product software and license file. Customers who are not on a current Service Agreement should contact your OpenEdge account representative. 

To confirm your current version of OpenEdge, run the “version” command in the “./bin” directory of your OpenEdge root install path ($DLC) or run the “PROVERSION” function from the OpenEdge ABL language. 

Mitigation Steps:

If you are unable to Upgrade at this time, please see the "CVE-2023-34203 Mitigations Final" document attached to this product alert for mitigation steps.
 

If you have any questions, concerns, or problems related to this issue, please login to open a new Technical Support case here for assistance or reach out to your application provider. Technical Support is available to OpenEdge customers under warranty and an active Service Agreement. 

We want to stress that security is of the utmost importance to us. Progress leverages development practices to minimize product vulnerabilities and we take prompt action to notify you of potential risks. We sincerely apologize for any inconvenience this situation may cause you. 

Sincerely,

The Progress OpenEdge Team