ZDI-24-894: Progress Software WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability

Published Jul 3, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2024-4884.

Affected Software

1 affected component

Progress Software WhatsUp Gold

Event History

Jul 3, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-24-894?

The severity of ZDI-24-894 is rated at 9.8 on the CVSS scale, indicating a critical vulnerability.

How do I fix ZDI-24-894?

To fix ZDI-24-894, update your Progress Software WhatsUp Gold to the latest patched version provided by the vendor.

What types of attacks can ZDI-24-894 facilitate?

ZDI-24-894 allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold.

Is authentication required to exploit ZDI-24-894?

No, authentication is not required to exploit ZDI-24-894, making it particularly dangerous.

What CVE is associated with ZDI-24-894?

The CVE associated with ZDI-24-894 is CVE-2024-4884.