Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-12108
CVE-2024-12108:
WhatsUp Gold vulnerability analysis and mitigation
Overview
In WhatsUp Gold versions released before 2024.0.2, a critical vulnerability (CVE-2024-12108) was discovered that allows attackers to gain access to the WhatsUp Gold server via the public API. The vulnerability was disclosed on December 31, 2024, and affects Progress Software Corporation's network monitoring solution (NVD, CVE).
Technical details
CVE-2024-12108 has been assigned a Critical severity with a CVSS v3.1 base score of 9.6. The vulnerability is classified as an Authentication Bypass by Spoofing (CWE-290). The attack vector is network-accessible (AV:N), requires low attack complexity (AC:L), needs low privileges (PR:L), requires no user interaction (UI:N), and can affect connected systems (S:C) with high impacts on both confidentiality and integrity (C:H, I:H) (Security Online).
Impact
The exploitation of this vulnerability could lead to severe security breaches, allowing attackers to gain complete control of WhatsUp Gold servers. According to research, approximately 110,000 WhatsUp Gold instances are exposed and at risk of being targeted, with the majority located in the U.S., followed by China, Japan, India, Canada, Germany, and Australia (SOCRadar).
Mitigation and workarounds
Progress Software Corporation has released version 24.0.2 of WhatsUp Gold to address this vulnerability. Organizations are strongly advised to immediately upgrade their WhatsUp Gold installations to this version to mitigate the risk (SOCRadar).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management