VulnerabilityModified

CVE-2024-5013

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified.

HIGH 7.5EPSS 0.85%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.85% probability · 56th percentile
CISA KEV: Not listed
Weakness: CWE-400
Affected: progress/whatsup gold
Source: security@progress.com

References

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024Vendor Advisory
https://www.progress.com/network-monitoringProduct
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024Vendor Advisory
https://www.progress.com/network-monitoringProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.