CVE-2024-5015: WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WhatsUp Goldto a version that resolves this vulnerability.Fixed in 2023.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5015?
CVE-2024-5015 is considered a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-5015?
To fix CVE-2024-5015, upgrade to WhatsUp Gold version 2023.1.3 or later.
What types of vulnerability does CVE-2024-5015 involve?
CVE-2024-5015 involves an authenticated SSRF vulnerability combined with improper access control.
Who is affected by CVE-2024-5015?
CVE-2024-5015 affects users of WhatsUp Gold versions prior to 2023.1.3.
Can CVE-2024-5015 be exploited by low privileged users?
Yes, CVE-2024-5015 can be exploited by low privileged users by chaining SSRF with improper access control.