CVE-2024-7346

Katalog CVE

CVSS 4.8 · Medium EPSS 0,16%

Kerentanan Improper Validation of Certificate with Host Mismatch pada progress openedge. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.  This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.  The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.

Rincian

Terbit di NVD

3 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-297: Improper Validation of Certificate with Host Mismatch
CWE-287: Improper Authentication

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.progress.com/s/article/Client-connections-using-default-TLS-certificates-from-OpenEdge-may-b... mitigasi · advisory vendor