CVE-2024-5011

In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request to the TestController Chart functionality can lead to denial of service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024	Vendor Advisory
https://www.progress.com/network-monitoring	Product
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1934	Third Party Advisory
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024	Vendor Advisory
https://www.progress.com/network-monitoring	Product
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1934	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-25 20:15

Updated : 2024-11-21 09:46

NVD link : CVE-2024-5011

Mitre link : CVE-2024-5011

CVE.ORG link : CVE-2024-5011

JSON object : View

Products Affected

progress

whatsup_gold

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2024-5011", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-06-25T20:15:13.810", "references": [{"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024", "tags": ["Vendor Advisory"], "source": "security@progress.com"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "security@progress.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1934", "tags": ["Third Party Advisory"], "source": "security@progress.com"}, {"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1934", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists.\u00a0A specially crafted unauthenticated HTTP request\u00a0to the TestController Chart functionality\u00a0can lead to denial of service."}, {"lang": "es", "value": "En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, existe una vulnerabilidad de consumo descontrolado de recursos. Una solicitud HTTP no autenticada especialmente manipulada para la funcionalidad TestController Chart puede provocar una denegaci\u00f3n de servicio."}], "lastModified": "2024-11-21T09:46:46.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C22487E3-6723-40C7-86A0-764EBAA37A55", "versionEndExcluding": "23.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}