CVE-2024-5015 WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability

High 7.1 Published 25 Jun 2024 Updated 1 Aug 2024

An authenticated SSRF in WhatsUp Gold allows low-privileged users to escalate privileges to Admin by chaining with access control flaws.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-5015?

CVE-2024-5015 is a high-severity server-side request forgery vulnerability in Progress Whatsup Gold, published on 25 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin.

Weakness: CWE-918

Which versions are affected by CVE-2024-5015?

It affects 1 product.

Products include Progress Whatsup Gold.

How do I fix CVE-2024-5015?

No fix has been published for CVE-2024-5015 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-5015 being exploited?

There is no known exploitation of CVE-2024-5015 in the wild and no public exploit code.

All Progress Whatsup Gold vulnerabilities

Sources

Also known as GHSA-mx99-9j8j-frc2.