#VU93508 Resource exhaustion in WhatsUp Gold - CVE-2024-5011
Vulnerability identifier: #VU93508
Vulnerability risk: Medium
CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2024-5011
CWE-ID:
CWE-400
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
WhatsUp Gold
Web applications /
CMS
Vendor: Progress Software Corporation
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the TestController Chart functionality. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
WhatsUp Gold: 2023.1.0 1697
External links
https://www.progress.com/network-monitoring
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1934
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
