Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2024-7346

Опубликовано: 03 сент. 2024
Источник: nvd
CVSS3: 7.2
CVSS3: 4.8
EPSS Низкий

Описание

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.  This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.  The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*
Версия до 11.7.19 (включая)
cpe:2.3:a:progress:openedge:*:*:*:*:lts:*:*:*
Версия от 12.0 (включая) до 12.2.14 (включая)

EPSS

Процентиль: 11%
0.00037
Низкий

7.2 High

CVSS3

4.8 Medium

CVSS3

Дефекты

CWE-297
CWE-287

Связанные уязвимости

CVSS3: 7.2
github
больше 1 года назад

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.  This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.  The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.

EPSS

Процентиль: 11%
0.00037
Низкий

7.2 High

CVSS3

4.8 Medium

CVSS3

Дефекты

CWE-297
CWE-287