CVE-2024-12108

The vulnerability classified as CWE-290 (Authentication Bypass by Spoofing) allows an attacker to bypass authentication or authorization mechanisms through the WhatsUp Gold public API. An attacker with basic network access (PR:L) can, without user interaction, submit crafted requests to the API, which are accepted by the server despite lacking appropriate permissions. The spoofing defense mechanism is ineffective, enabling takeover of the server context.

An attacker can gain unauthorized access to the WhatsUp Gold server, risking disclosure of sensitive configuration data and network monitoring data (C:H) as well as modification of system data or configuration (I:H). The scope of the attack extends beyond the directly vulnerable component (S:C), which may lead to further lateral movement in the infrastructure.

Progress WhatsUp Gold must be updated immediately to version 2024.0.2 or newer. Detailed information about the patch is available at https://www.progress.com/network-monitoring. Until the update is applied, it is recommended to restrict access to the public API to trusted IP addresses only through firewall rules.

Progress WhatsUp Gold in all versions released before 2024.0.2, running on the Microsoft Windows platform