Paper/Archive/CVE-2024-4884

CVE-2024-4884

Progress Software Corporation WhatsUp Gold — WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability

EPSS 24%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 97.9.979 × 2019.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Controllers.CommunityController allows execution of commands with iisapppool\nmconsole privileges.

Affected

ProductAffectedFixed inSource

WhatsUp Gold2023.1.0 – < 2023.1.32023.1.3CNA

whatsup_gold2023.1.0 – < 2023.1.32023.1.3CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ProgressSoftware (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refprogress.com/network-monitoring advisorycommunity.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024