Skip to main content

Whatsup Gold CVE-2024-5009

HIGH
Improper Privilege Management (CWE-269)
2024-06-25 security@progress.com
Privilege Escalation Whatsup Gold
8.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 25, 2024 - 20:15 nvd
HIGH 8.4

DescriptionNVD

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.

AnalysisAI

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password. Affected products include: Progress Whatsup Gold. Version information: before 2023.1.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.

More in Whatsup Gold

View all
CVE-2012-2601 HIGH POC
7.5 Aug 15

SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
CVE-2015-8261 CRITICAL POC
9.8 Jan 08

The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
CVE-2024-6671 CRITICAL POC
9.8 Aug 29

In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
CVE-2024-6670 CRITICAL POC
9.8 Aug 29

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
CVE-2024-4885 CRITICAL POC
9.8 Jun 25

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
CVE-2015-6004 MEDIUM POC
6.5 Dec 27

Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary

CVE-2022-29847 HIGH POC
7.5 May 11

In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to i
CVE-2015-6005 MEDIUM POC
6.9 Dec 27

Multiple cross-site scripting (XSS) vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to injec
CVE-2024-5017 MEDIUM POC
6.5 Jun 25

In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. Rated medium severity (CVSS 6.
CVE-2022-29848 MEDIUM POC
6.5 May 11

In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke

CVE-2022-29845 MEDIUM POC
6.5 May 11

In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke

CVE-2012-4344 MEDIUM POC
4.3 Aug 15

Cross-site scripting (XSS) vulnerability in Ipswitch WhatsUp Gold 15.02 allows remote attackers to inject arbitrary web

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2016-0151 HIGH POC
7.8
CVE-2013-0643 HIGH
8.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2024-5009 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy