CVE-2024-2448 LoadMaster Command Injection Vulnerability
Authenticated users can inject OS commands into the LoadMaster UI, leading to arbitrary code execution on the underlying system.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2448?
CVE-2024-2448 is a high-severity command injection vulnerability in Progress Software LoadMaster, published on 22 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.
Weakness: CWE-78
Which versions are affected by CVE-2024-2448?
It affects 1 product.
Products include Progress Loadmaster.
How do I fix CVE-2024-2448?
No fix has been published for CVE-2024-2448 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-2448 being exploited?
There is no known exploitation of CVE-2024-2448 in the wild and no public exploit code.
Other vulnerabilities in Progress Software LoadMaster
- CVE-2024-1212 Progress Kemp LoadMaster OS Command Injection
- CVE-2014-5287 Command injection in n/a
- CVE-2024-56131 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56132 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56133 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
Sources
Also known as GHSA-q953-jqf9-xxc3.