CVE-2024-4883 - WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

Back Back to CVE browser

CRITICAL

WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

Published Jun 25, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 64.53%

Description

In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.

Affected products

Vendor Progress Software Corporation Product WhatsUp Gold Default
affected
- Version
  2023.1.0
  Status
  affected
  Constraints
  <2023.1.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress Software Corporation

WhatsUp Gold

affected

Version	Status	Constraints
2023.1.0	affected	<2023.1.3

Vendor Progress Product Whatsup Gold Default
affected
- Version
  2023.1.0
  Status
  affected
  Constraints
  <2023.1.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress

Whatsup Gold

affected

Version	Status	Constraints
2023.1.0	affected	<2023.1.3

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-77

CWE-78

OS Command Injection

CWE-94

Code Injection

References (3)

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44453
Advisory
https://www.progress.com/network-monitoring
product

Link	Providers	Tags
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024		vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44453		Advisory
https://www.progress.com/network-monitoring		product