PT-2024-32279 · Progress · Whatsup Gold

Andy Niu · Published 2024-09-26 · Updated 2025-11-10 · CVE-2024-46909

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Software WhatsUp Gold versions prior to 2024.0.1

Description This issue involves a directory traversal that can lead to remote code execution. An unauthenticated remote attacker can exploit this to execute code within the context of the service account.

Recommendations Update WhatsUp Gold to version 2024.0.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-16

CWE-73

CWE-22

Related Identifiers

CVE-2024-46909

ZDI-24-1645

Affected Products

Whatsup Gold

References · 21

• https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-September-2024 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-46909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46909 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-1645 · Security Note
• https://t.me/cvedetector/11786 · Telegram Post
• https://twitter.com/CVEnew/status/1863611843442561483 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1866847683790393520 · Twitter Post
• https://twitter.com/CCBalert/status/1840757289734603175 · Twitter Post
• https://reddit.com/r/cybersecurity/comments/1hbaolq/progress_software_whatsup_gold_writedatafile · Reddit Post
• https://twitter.com/Dhananj82759483/status/1839675418183692456 · Twitter Post
• https://t.me/CSIRT_italia/2878 · Telegram Post
• https://twitter.com/Dhananj82759483/status/1839675377889017960 · Twitter Post
• https://docs.progress.com/bundle/whatsupgold-release-notes-24-0/page/WhatsUp-Gold-2024.0-Release-Notes.html · Note
• https://progress.com/network-monitoring · Note
• https://twitter.com/vFeed_IO/status/1864069196499570878 · Twitter Post