Vulnerabilities > CVE-2024-5015 - Server-Side Request Forgery (SSRF) vulnerability in Progress Whatsup Gold

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

progress

CWE-918

NVD

Published: 2024-06-25

Updated: 2024-08-21

Summary

In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin.

Vulnerable Configurations

Part	Description	Count
Application	Progress Progress Whatsup Gold - Progress Whatsup Gold 7.0 Progress Whatsup Gold 7.03 Progress Whatsup Gold 7.04 Progress Whatsup Gold 8.0 Progress Whatsup Gold 8.01 Progress Whatsup Gold 8.03 Progress Whatsup Gold 11 Progress Whatsup Gold 15.02 Progress Whatsup Gold 16.3 Progress Whatsup Gold 16.4 Progress Whatsup Gold 17.1.1 Progress Whatsup Gold 18.0 Progress Whatsup Gold 21.1.0 Progress Whatsup Gold 21.1.1 Progress Whatsup Gold 21.1.2 Progress Whatsup Gold 22.0.0 Progress Whatsup Gold 22.0.1 Progress Whatsup Gold 22.0.2 Progress Whatsup Gold 22.1.0 Progress Whatsup Gold 23.0.0 Progress Whatsup Gold 23.0.1 Progress Whatsup Gold 23.0.2 Progress Whatsup Gold 23.1.0 Progress Whatsup Gold 23.1.1 Progress Whatsup Gold 23.1.2	27

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References