CVE-2024-4562

In WhatsUp Gold versions released before 2023.1.2 , an SSRF vulnerability exists in Whatsup Gold's Issue exists in the HTTP Monitoring functionality. Due to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality, what leads to the Server Side Request Forgery.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2	Vendor Advisory
https://www.progress.com/network-monitoring	Product
https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2	Vendor Advisory
https://www.progress.com/network-monitoring	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*

History

09 Dec 2024, 13:40

Type	Values Removed	Values Added
References	~~() https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2 - Release Notes~~	() https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2 - Vendor Advisory

09 Dec 2024, 13:18

Type	Values Removed	Values Added
First Time		Progress whatsup Gold Progress
References	~~() https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2 -~~	() https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2 - Release Notes
References	~~() https://www.progress.com/network-monitoring -~~	() https://www.progress.com/network-monitoring - Product
CPE		cpe:2.3:a:progress:whatsup_gold::::::::

Information

Published : 2024-05-14 21:15

Updated : 2024-12-09 13:40

NVD link : CVE-2024-4562

Mitre link : CVE-2024-4562

CVE.ORG link : CVE-2024-4562

JSON object : View

Products Affected

progress

whatsup_gold

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-4562", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2024-05-14T21:15:13.767", "references": [{"url": "https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2", "tags": ["Vendor Advisory"], "source": "security@progress.com"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "security@progress.com"}, {"url": "https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "\nIn WhatsUp Gold versions released before 2023.1.2 , \n\nan SSRF vulnerability exists in Whatsup Gold's \n\nIssue exists in the HTTP Monitoring functionality.\u00a0 \n\nDue to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality, what leads to the Server Side Request Forgery.\n\n"}, {"lang": "es", "value": "En las versiones de WhatsUp Gold lanzadas antes de 2023.1.2, existe una vulnerabilidad SSRF en Whatsup Gold. El problema existe en la funcionalidad de monitoreo HTTP. Debido a la falta de autorizaci\u00f3n adecuada, cualquier usuario autenticado puede acceder a la funcionalidad de monitoreo HTTP, lo que conduce a Server Side Request Forgery."}], "lastModified": "2024-12-09T13:40:22.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF563542-A8E7-49AD-B46C-8C222CDE1016", "versionEndExcluding": "23.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}