Vulnerabilities

TI-2024-04661 CVE-2024-5019 · GHSA-vrxq-687c-64w5

WhatsUp Gold LoadCSSUsingBasePath Directory Traversal Information Disclosure Vulnerability

MEDIUM 40

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00771 Published 2024-06-25 Fixed in 2023.1.3 CWE-22

TI-2024-04660 CVE-2024-5018 · GHSA-jpqc-c443-hw5c

WhatsUp Gold LoadUsingBasePath Directory Traversal Information Disclosure Vulnerability

MEDIUM 40

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00771 Published 2024-06-25 Fixed in 2023.1.3 CWE-22

TI-2024-04659 CVE-2024-5017 · GHSA-rxw3-jm8w-c989

WhatsUp Gold AppProfileImport path traversal vulnerability

MEDIUM 62

In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01636 Published 2024-06-25 Fixed in 2023.1.3 CWE-22

TI-2024-04658 CVE-2024-5016 · GHSA-5qqw-chw3-g8wp

WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability

MEDIUM 54

In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.22367 Published 2024-06-25 Fixed in 2023.1.3 CWE-502

TI-2024-04657 CVE-2024-5015 · GHSA-mx99-9j8j-frc2

WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability

LOW 39

In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Contr…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00525 Published 2024-06-25 Fixed in 2023.1.3 CWE-918

TI-2024-04656 CVE-2024-5014 · GHSA-3325-26ch-q5p3

WhatsUp Gold GetASPReport Server-Side Request Forgery Information Disclosure

LOW 34

In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00477 Published 2024-06-25 Fixed in 2023.1.3 CWE-918

TI-2024-04655 CVE-2024-5013 · GHSA-vp43-wpfx-v79m

WhatsUp Gold InstallController Denial-of-Service Vulnerability

MEDIUM 40

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00847 Published 2024-06-25 Fixed in 2023.1.3 CWE-400

TI-2024-04654 CVE-2024-5012 · GHSA-pw52-mhpv-c8hc

WhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure Vulnerability

MEDIUM 44

In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00445 Published 2024-06-25 Fixed in 2023.1.3 CWE-287

TI-2024-04653 CVE-2024-5011 · GHSA-67p8-jrm8-g765

WhatsUp Gold TestController Chart denial of service vulnerability

HIGH 72

In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.47092 Published 2024-06-25 Fixed in 2023.1.3 CWE-400

TI-2024-04652 CVE-2024-5010 · GHSA-rw28-wf4m-hxpv

WhatsUp Gold TestController multiple information disclosure vulnerabilities

HIGH 76

In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.69952 Published 2024-06-25 Fixed in 2023.1.3 CWE-200

TI-2024-04651 CVE-2024-5009 · GHSA-j3rp-hcww-24pq

WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability

HIGH 72

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.1742 Published 2024-06-25 Fixed in 2023.1.3 CWE-269

TI-2024-04650 CVE-2024-5008 · GHSA-5prg-92hj-2g9x

WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability

MEDIUM 57

In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.1733 Published 2024-06-25 Fixed in 2023.1.3 CWE-434

TI-2024-04541 CVE-2024-4885 · GHSA-qcj6-wq2r-c3xh

WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

CRITICAL 100KEV

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99288 Published 2024-06-25 Fixed in 2023.1.3 CWE-22

TI-2024-04540 CVE-2024-4884 · GHSA-2jfg-r68g-p4gm

WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability

HIGH 70

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.24306 Published 2024-06-25 Fixed in 2023.1.3 CWE-77

TI-2024-04539 CVE-2024-4883 · GHSA-mp2r-5xxf-j299

WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

CRITICAL 85

In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64535 Published 2024-06-25 Fixed in 2023.1.3 CWE-77

Vulnerabilities

Filters