CVE-2024-7346
Last modified
CVE-2024-7346 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security. The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security. The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Progress | Openedge | <= 11.7.19 |
| Progress | Openedge | >= 12.0, <= 12.2.14 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-7346?
How severe is CVE-2024-7346?
How do I fix CVE-2024-7346?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-7340The Weave server API allows remote users to fetch files from…8.8
- CVE-2024-7341A session fixation issue was discovered in the SAML adapters…7.1
- CVE-2024-7342A vulnerability was found in Baidu UEditor 1.4.3.3. It has b…6.1
- CVE-2024-7343A vulnerability was found in Baidu UEditor 1.4.2. It has bee…6.1
- CVE-2024-7344Howyar UEFI Application "Reloader" (32-bit and 64-bit) is …8.2
- CVE-2024-7345Local ABL Client bypass of the required PASOE security check…9.6
- CVE-2024-7347NGINX Open Source and NGINX Plus have a vulnerability in the…4.7
- CVE-2024-7348Time-of-check Time-of-use (TOCTOU) race condition in pg_dump…7.5
- CVE-2024-7349The LifterLMS – WP LMS for eLearning, Online Courses, & Quiz…7.2
- CVE-2024-7350The Appointment Booking Calendar Plugin and Online Schedulin…9.8
- CVE-2024-7351The Simple Job Board plugin for WordPress is vulnerable to P…7.2
- CVE-2024-7352PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remo…7.8
Are you affected by CVE-2024-7346?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST