CVE-2024-2449 HIGH

CVE-2024-2449: LoadMaster Cross-Site Request Forgery (CSRF)

Vendor Progress Software
Product LoadMaster
Weakness CWE-352 · CSRF
Published March 22, 2024
Last update August 12, 2024

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A cross-site request forgery vulnerability has been identified in LoadMaster.  It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.

Key dates

02Disclosure timeline

March 22, 2024 CVE published
August 12, 2024 Record updated

Related vulnerabilities

04Related CVE