CVE-2025-7388

Published Sep 4, 2025

Last updated 6 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-7388 is a vulnerability in Progress OpenEdge AdminServer that allows for Remote Command Execution (RCE) via the Java RMI interface. Authenticated users can inject and execute OS commands with the privileges of the AdminServer process. The vulnerability stems from inadequate input validation on a configuration property, which leads to OS command injection. Specifically, the manipulation of the `workDir` parameter, passed as the `-w jvmStart` argument, allows attackers to inject OS commands by manipulating quotes within the input value. This results in arbitrary command execution with the elevated privileges of the AdminServer process.

Description: It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted manipulation of a configuration property with inadequate input validation leading to OS command injection.
Source: security@progress.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.4
Impact score: 6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Severity: HIGH

Weaknesses

security@progress.com: CWE-77

Hype score: Not currently trending

References