CVE-2024-4885
Progress WhatsUp Gold Path Traversal Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 99.29% probability · 100th percentile
- CISA KEV
- Listed 3 March 2025 · due 24 March 2025
- Weakness
- CWE-22
- Affected
- progress/whatsup gold
- Source
- security@progress.com
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-4885
References
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024Vendor Advisory
- https://www.progress.com/network-monitoringProduct
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024Vendor Advisory
- https://www.progress.com/network-monitoringProduct
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4885US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.