CVE-2024-4885 : In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Co

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

Published 2024-06-25 19:48:15

Updated 2025-03-04 02:00:02

Source Progress Software Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2024-4885

Progress » Whatsup Gold
Versions before (<) 23.1.3
cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*
Matching versions
Progress » Whatsup Gold
Versions from including (>=) 2023.1.0 and before (<) 2023.1.3
cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*
Matching versions

CVE-2024-4885 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Progress WhatsUp Gold Path Traversal Vulnerability

CISA required action:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA description:

Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.

Notes:

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-4885

Added on 2025-03-03 Action due date 2025-03-24

Exploit prediction scoring system (EPSS) score for CVE-2024-4885

EPSS FAQ

94.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2024-4885

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	N/A	N/A	Progress Software Corporation	2024-06-25
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST	2024-09-06
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	Progress Software Corporation	2024-06-25
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2024-4885

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Assigned by:
- f9fea0b6-671e-4eea-8fde-31911902ae05 (Primary)
- security@progress.com (Secondary)

References for CVE-2024-4885

https://www.progress.com/network-monitoring

WhatsUp Gold Network Monitoring Software | Progress
Product

CVEs referencing this url
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024

WhatsUp Gold Security Bulletin– June 2024 - Progress Community
Vendor Advisory

CVEs referencing this url