Vulnerabilities > CVE-2024-4561 - Server-Side Request Forgery (SSRF) vulnerability in Progress Whatsup Gold

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

progress

CWE-918

NVD

Published: 2024-05-14

Updated: 2024-12-09

Summary

In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server.

Vulnerable Configurations

Part	Description	Count
Application	Progress Progress Whatsup Gold - Progress Whatsup Gold 7.0 Progress Whatsup Gold 7.03 Progress Whatsup Gold 7.04 Progress Whatsup Gold 8.0 Progress Whatsup Gold 8.01 Progress Whatsup Gold 8.03 Progress Whatsup Gold 11 Progress Whatsup Gold 15.02 Progress Whatsup Gold 16.3 Progress Whatsup Gold 16.4 Progress Whatsup Gold 17.1.1 Progress Whatsup Gold 18.0 Progress Whatsup Gold 21.1.0 Progress Whatsup Gold 21.1.1 Progress Whatsup Gold 21.1.2 Progress Whatsup Gold 22.0.0 Progress Whatsup Gold 22.0.1 Progress Whatsup Gold 22.0.2 Progress Whatsup Gold 22.1.0 Progress Whatsup Gold 23.0.0 Progress Whatsup Gold 23.0.1 Progress Whatsup Gold 23.0.2 Progress Whatsup Gold 23.1.0 Progress Whatsup Gold 23.1.1	26

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References