{"id":"CVE-2023-40051","aliases":["EUVD-2023-44658","GHSA-8crr-j42r-277p"],"status":"published","title":"Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal","description":"This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00557,"percentile":0.46933,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2024-01-18T15:11:04Z","modified":"2026-06-17T06:15:57Z","products":[{"vendor":"progress","product":"openedge"},{"vendor":"progress","product":"openedge_innovation"},{"vendor":"progress software corporation","product":"openedge"}],"references":[{"url":"https://www.progress.com/openedge","tags":["product","x_transferred","Product"]},{"url":"https://community.progress.com/s/article/Important-Progress-OpenEdge-Critical-Alert-for-Progress-Application-Server-in-OpenEdge-PASOE-Arbitrary-File-Upload-Vulnerability-in-WEB-Transport","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40051"},{"url":"https://github.com/advisories/GHSA-8crr-j42r-277p"}],"sources":{"cve":[{"id":"CVE-2023-40051","title":"Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal","description":"This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.\n\n\n\n","status":"published","published":"2024-01-18T15:11:04.08Z","modified":"2025-06-02T15:03:50.714Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:35:21.971258Z"}],"euvd":[{"id":"EUVD-2023-44658","description":"This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.\n\n\n\n","status":"published","published":"2024-01-18T15:11:04Z","modified":"2025-06-02T15:03:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T20:32:33.292081Z"}],"ghsa":[{"id":"GHSA-8crr-j42r-277p","title":"This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7...","description":"This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.\n\n\n\n","status":"published","published":"2024-01-18T15:30:40Z","modified":"2024-01-18T15:30:40Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:55:26.812198Z"}],"nvd":[{"id":"CVE-2023-40051","description":"This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE.  If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.\n\n\n\n","status":"published","published":"2024-01-18T15:15:09.06Z","modified":"2026-06-17T06:15:57.613Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:09:01.900189Z"}]}}