How severe is CVE-2007-3491?

CVE-2007-3491 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2007-3491 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (83rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-3491?

CVE-2007-3491 primarily affects Progress Openedge. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2007-3491?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2007-3491 published?

CVE-2007-3491 was published on 2007-06-29 and last updated on 2026-06-16.

CVE-2007-3491

CVE-2007-3491 is a high-severity vulnerability in Progress Openedge with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 3% (83rd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Progress Openedge
Published: 2007-06-29
Last modified: 2026-06-16

Description

Buffer overflow in _mprosrv in Progress Software OpenEdge before 9.1E0422, and 10.x before 10.1B01, allows remote attackers to have an unknown impact via a malformed TCP/IP message.

Frequently asked questions

What is CVE-2007-3491?: Buffer overflow in _mprosrv in Progress Software OpenEdge before 9.1E0422, and 10.x before 10.1B01, allows remote attackers to have an unknown impact via a malformed TCP/IP message.
How severe is CVE-2007-3491?: CVE-2007-3491 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2007-3491 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (83rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2007-3491?: CVE-2007-3491 primarily affects Progress Openedge. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2007-3491?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2007-3491 published?: CVE-2007-3491 was published on 2007-06-29 and last updated on 2026-06-16.

References

Affected products (3)

cpe:2.3:a:progress:openedge:9.1e:*:*:*:*:*:*:*
cpe:2.3:a:progress:openedge:10.1a:*:*:*:*:*:*:*
cpe:2.3:a:progress:openedge:10.1b:*:*:*:*:*:*:*

More vulnerabilities in Progress Openedge

CVE-2024-1403 — Critical (CVSS 10.0): In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the…
CVE-2007-2417 — Critical (CVSS 10.0): Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and OpenEdge 10.1x, as used by the RSA…
CVE-2015-9245 — Critical (CVSS 9.8): Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to…
CVE-2023-40051 — Critical (CVSS 9.1): This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to…
CVE-2023-34203 — High (CVSS 8.8): In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM…
CVE-2024-7654 — High (CVSS 8.3): An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM…

All CVEs affecting Progress Openedge →