CVE-2024-5009 | Vulnetix

CVE-2024-5009 PUBLISHED CVSS 8.399999618530273 HIGH

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.

EPSS 17.42% · 96.9th percentile

Risk Scores

CVSS 3.1

8.399999618530273

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

17.42%

96.9th percentile

Affected Products

Vendor	Product	Versions
progress	whatsup_gold	0, 0, 0
progress	whatsup_gold	2023.1.0, 2023.1.0, 2023.1.0
Progress Software Corporation	WhatsUp Gold	2023.1.0, 2023.1.0, 2023.1.0

Timeline

CVE Published
Jun 26, 2024 EPSS Score
Jul 8, 2024 PoC Published
Jul 9, 2024 PoC Published
Jul 9, 2024 PoC Published
Jul 9, 2024 PoC Published
Jul 11, 2024 PoC Published
Jul 11, 2024 PoC Published
Aug 1, 2024 PoC Published
Aug 1, 2024 PoC Published
Aug 1, 2024 PoC Published
Aug 1, 2024 PoC Published

References

https://nvd.nist.gov/vuln/detail/CVE-2024-5009 advisory
https://www.progress.com/network-monitoring vendor
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 vendor-advisory

Open in Interactive Console →