CVE-2024-5015 HIGH

CVE-2024-5015: WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability

Vendor Progress Software Corporation
Product WhatsUp Gold
Weakness CWE-918 · SSRF
Published June 25, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin.

Key dates

02Disclosure timeline

June 25, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-13697 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links CVE-2026-45548 Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation CVE-2024-4084 SSRF vulnerability in mintplex-labs/anything-llm CVE-2026-4308 frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery CVE-2020-17386 Cellopoint CelloOS - Server-Side Request Forgery (SSRF)