CVE-2024-7346 - CVE House
Back to Database
Status published High CVE-2024-7346

Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation

Vulnerability Description

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.  This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.  The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7346

Credits & Attribution

No credits recorded in the NVD database.

References

More from Progress

View All →
CVE-2025-2324
A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder
Medium 5.9
CVE-2025-1758
Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer...
Medium 4.3
CVE-2025-13147
External Service Interaction (DNS)
Medium 5.3
CVE-2025-11235
MOVEit Transfer REST API does not require current password in order to initiate the password change process
Low 3.7
CVE-2025-10932
AS2 module allows uncontrolled file uploads
High 8.2

Affected Vendor

Affected Software

OpenEdge
Vulnerable Versions:
11.7.0, 12.2.0, 12.8.0

Timeline

Official Publish: September 3rd, 2024
Last Modified: September 3rd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-297

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.