CVE-2022-29849

In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privilege escalation. If exploited, a local attacker could elevate their privileges and compromise the affected system.

• https://community.progress.com/s/article/OpenEdge-11-7-14-is-Now-AvailablePatch, Release Notes, Vendor Advisory
• https://community.progress.com/s/article/OpenEdge-12-2-9-Update-is-availablePatch, Vendor Advisory
• https://community.progress.com/s/article/Remediation-of-Privilege-Escalation-Security-Vulnerability-CVE-2022-29849Mitigation, Vendor Advisory
• https://www.progress.com/openedgeProduct
• https://community.progress.com/s/article/OpenEdge-11-7-14-is-Now-AvailablePatch, Release Notes, Vendor Advisory
• https://community.progress.com/s/article/OpenEdge-12-2-9-Update-is-availablePatch, Vendor Advisory
• https://community.progress.com/s/article/Remediation-of-Privilege-Escalation-Security-Vulnerability-CVE-2022-29849Mitigation, Vendor Advisory
• https://www.progress.com/openedgeProduct

Published

May 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29843A command injection vulnerability in the DDNS service config…9.8
• CVE-2022-29844A vulnerability in the FTP service of Western Digital My Clo…9.8
• CVE-2022-29845In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and…6.5
• CVE-2022-29846In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 2…5.3
• CVE-2022-29847In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and…7.5
• CVE-2022-29848In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and…6.5
• CVE-2022-2985In music service, there is a missing permission check. This …7.8
• CVE-2022-29850Various Lexmark products through 2022-04-27 allow an attacke…8.1
• CVE-2022-29851documentconverter in OX App Suite through 7.10.6, in a non-d…9.8
• CVE-2022-29852OX App Suite through 8.2 allows XSS because BMFreehand10 and…5.4
• CVE-2022-29853OX App Suite through 8.2 allows XSS via a certain complex hi…5.4
• CVE-2022-29854A vulnerability in Mitel 6900 Series IP (MiNet) phones exclu…6.8