VDB
CVE-2024-4885
CVE-2024-4885
PUBLISHED
KEV
CVSS 9.800000190734863 CRITICAL
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
EPSS 99.29% · 99.9th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
99.29%
99.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| progress | whatsup_gold | 2023.1.0 |
| Progress Software Corporation | WhatsUp Gold | 2023.1.0 |
| progress | whatsup_gold | 0 |
Timeline
- CVE Published
- Jun 26, 2024 EPSS Score
- Jul 8, 2024 VulnCheck XDB Entry
- Jul 19, 2024 EPSS Score
- Aug 6, 2024 VulnCheck KEV Exploitation
- Aug 7, 2024 VulnCheck KEV Exploitation
- Aug 8, 2024 VulnCheck KEV Exploitation
- Aug 11, 2024 VulnCheck KEV Exploitation
- Aug 14, 2024 VulnCheck KEV Exploitation
- Aug 19, 2024 VulnCheck KEV Exploitation
- Aug 20, 2024 VulnCheck KEV Exploitation
- Aug 22, 2024 VulnCheck KEV Exploitation
References
- Nuclei Template exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4885 advisory
- https://www.progress.com/network-monitoring url
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-4885 advisory