CVE-2025-7389— Unauthorized Arbitrary File Read via RMI in AdminServer Interface
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-7389
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthorized Arbitrary File Read via RMI in AdminServer Interface
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile() methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对外部实体的文件或目录可访问
Source: NVD (National Vulnerability Database)
Vulnerability Title
Progress OpenEdge 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress OpenEdge是美国Progress公司的一个企业级应用开发与数据库管理平台。 Progress OpenEdge存在安全漏洞，该漏洞源于AdminServer组件授权不当，可能导致认证用户通过RMI接口滥用setFile和openFile方法读取主机系统上的任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software Corporation | OpenEdge | OpenEdge 12.2.0 ~ 12.2.9 | - |
II. Public POCs for CVE-2025-7389
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-7389
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: OpenEdge
- CVE-2025-8095
Recoverable obfuscation using the OECH1 prefix encoding in O - CVE-2025-7388
Authenticated Command Injection via configuration parameter - CVE-2024-7346
Client connections using default TLS certificates from OpenE - CVE-2024-7345
Direct local client connections to MS Agents can bypass auth - CVE-2024-7654
Unauthenticated Content Injection in OpenEdge Management web
Same vendor: Progress Software Corporation
- CVE-2025-8095
Recoverable obfuscation using the OECH1 prefix encoding in O - CVE-2025-7388
Authenticated Command Injection via configuration parameter - CVE-2025-2572
WhatsUp Gold NmConfigurationManager.exe database manipulatio - CVE-2025-1968
Progress Sitefinity 代码问题漏洞 - CVE-2024-6097
Absolute Path Traversal Vulnerability
Same weakness: CWE-552
- CVE-2019-25709
CF Image Hosting Script 1.6.5 Unauthorized Database Access - CVE-2026-33698
Chamilo LMS affected by unauthenticated RCE in main/install - CVE-2021-47960
Synology SSL VPN Client 安全漏洞 - CVE-2026-35446
LORIS has a path traversal in FilesDownloadHandler - CVE-2026-34392
LORIS has a path traversal in static router
V. Comments for CVE-2025-7389
No comments yet