CVE-2025-7388

Katalog CVE

CVSS 8.4 · High EPSS 0,92%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection'). Skor CVSS 3.1 8.4 (High) menurut progress.com.

Deskripsi (NVD)

It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the AdminServer process.  An RMI interface permitted manipulation of a configuration property with inadequate input validation leading to OS command injection.

Rincian

Terbit di NVD

4 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.4 (High), sumber progress.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://community.progress.com/s/article/Important-RCE-Security-Update-for-OpenEdge-AdminServer