How severe is CVE-2023-40051?

CVE-2023-40051 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.

Is CVE-2023-40051 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-40051?

CVE-2023-40051 primarily affects Progress Openedge. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-40051?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2023-40051 have an EU (EUVD) identifier?

Yes. CVE-2023-40051 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-44658.

When was CVE-2023-40051 published?

CVE-2023-40051 was published on 2024-01-18 and last updated on 2026-06-17.

CVE-2023-40051

CVE-2023-40051 is a critical-severity vulnerability in Progress Openedge with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-434.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2023-44658
Weakness: CWE-434
Affected product: Progress Openedge
Published: 2024-01-18
Last modified: 2026-06-17

Description

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

Frequently asked questions

What is CVE-2023-40051?: This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.
How severe is CVE-2023-40051?: CVE-2023-40051 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.
Is CVE-2023-40051 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-40051?: CVE-2023-40051 primarily affects Progress Openedge. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-40051?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2023-40051 have an EU (EUVD) identifier?: Yes. CVE-2023-40051 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-44658.
When was CVE-2023-40051 published?: CVE-2023-40051 was published on 2024-01-18 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:progress:openedge:*:*:*:*:*:*:*:*
cpe:2.3:a:progress:openedge_innovation:*:*:*:*:*:*:*:*

More vulnerabilities in Progress Openedge

CVE-2024-1403 — Critical (CVSS 10.0): In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the…
CVE-2007-2417 — Critical (CVSS 10.0): Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and OpenEdge 10.1x, as used by the RSA…
CVE-2015-9245 — Critical (CVSS 9.8): Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to…
CVE-2023-34203 — High (CVSS 8.8): In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM…
CVE-2024-7654 — High (CVSS 8.3): An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM…
CVE-2024-7345 — High (CVSS 8.3): Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code…

All CVEs affecting Progress Openedge →

Other CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities

CVE-2026-48283 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type…
CVE-2026-48276 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type…
CVE-2026-57700 — Critical (CVSS 10.0): Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This…
CVE-2025-69129 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7…
CVE-2026-40772 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.
CVE-2026-40412 — Critical (CVSS 10.0): Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code…

Browse all CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities →