CVE-2024-4562: 
WhatsUp Gold vulnerability analysis and mitigation

A Server-Side Request Forgery (SSRF) vulnerability was discovered in WhatsUp Gold versions prior to 2023.1.2. The vulnerability exists in the HTTP Monitoring functionality, where any authenticated user can access this feature without proper authorization (NVD, ZDI).

The vulnerability is identified as CVE-2024-4562 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The specific flaw exists within the HttpContentActiveController class, where the lack of proper authorization controls allows authenticated users to access HTTP monitoring functionality. This vulnerability is classified as CWE-918 (Server-Side Request Forgery) (ZDI, NVD).

The vulnerability allows remote attackers to disclose sensitive information on affected installations of Progress Software WhatsUp Gold. An attacker can leverage this vulnerability to disclose information in the context of the application (ZDI).

The vulnerability requires authentication to exploit. Any authenticated user can access the HTTP monitoring functionality, which can lead to Server Side Request Forgery (NVD).

Progress Software has released version 2023.1.2 of WhatsUp Gold to address this vulnerability. Users are advised to upgrade to this version to mitigate the risk (ZDI).