CVE-2025-7389
Last modified
CVE-2025-7389 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile() methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile() methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | OpenEdge | >= OpenEdge 12.2.0, <= 12.2.9; >= OpenEdge 12.8.0, <= 12.2.18 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2025-7389?
How severe is CVE-2025-7389?
How do I fix CVE-2025-7389?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-7383Padding oracle attack vulnerability in Oberon microsystem AG…5.9
- CVE-2025-7384The Database for Contact Form 7, WPforms, Elementor forms pl…9.8
- CVE-2025-7385Input from search query parameter in GOV CMS is not sanitize…9.3
- CVE-2025-7386Information exposure vulnerability in Hitachi Storage Naviga…6.8
- CVE-2025-7387The Lana Downloads Manager plugin for WordPress is vulnerabl…5.5
- CVE-2025-7388It was possible to perform Remote Command Execution (RCE) vi…8.4
- CVE-2025-7390A malicious client can bypass the client certificate trust c…9.1
- CVE-2025-7392Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2025-7393Improper Restriction of Excessive Authentication Attempts vu…9.8
- CVE-2025-7394In the OpenSSL compatibility layer implementation, the funct…9.8
- CVE-2025-7395A certificate verification error in wolfSSL when building wi…9.2
- CVE-2025-7396In wolfSSL release 5.8.2 blinding support is turned on by de…4.6
Are you affected by CVE-2025-7389?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST