Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-7346
CVE-2024-7346:
Progress OpenEdge vulnerability analysis and mitigation
Overview
CVE-2024-7346 is a security vulnerability affecting OpenEdge software where host name validation for TLS certificates is bypassed when using installed OpenEdge default certificates during TLS handshake for networked connections. The vulnerability was disclosed in September 2024 and affects OpenEdge versions up to 11.7.19 and LTS versions from 12.0 up to 12.2.14 (NVD).
Technical details
The vulnerability allows bypass of host name validation when using default OpenEdge TLS certificates for network connections. It has received a CVSS v3.1 base score of 7.2 (HIGH) from Progress Software Corporation with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, while NIST assigned a score of 4.8 (MEDIUM) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. The vulnerability is classified under CWE-287 (Improper Authentication) and CWE-297 (Improper Validation of Certificate with Host Mismatch) (NVD).
Impact
When exploited, this vulnerability could lead to security issues as the default certificates override host name validation, potentially compromising the security of networked connections. This affects the integrity of TLS certificate validation processes, which are crucial for secure network communications (NVD).
Mitigation and workarounds
The recommended mitigation is to replace the existing default certificates with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation. This ensures that default certificates can no longer override host name validation where full TLS certificate validation is needed for network security (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management