critical9.8Known exploited
CVE-2024-4885
Progress WhatsUp Gold Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-03-03. Federal due date: 2025-03-24.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Progress | Whatsup Gold | before 23.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
- https://www.progress.com/network-monitoring
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
- https://www.progress.com/network-monitoring
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4885