CVE-2024-5015: 
WhatsUp Gold vulnerability analysis and mitigation

CVE-2024-5015 is a security vulnerability affecting WhatsUp Gold versions prior to 2023.1.3. The vulnerability was discovered and reported on April 24, 2024, and publicly disclosed on July 3, 2024. It involves an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Wug.UI.Areas.Wug.Controllers.SessionControler.Update component, which can be chained with an Improper Access Control vulnerability (ZDI Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) by NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Progress Software Corporation assigned it a score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. The specific flaw exists within the SessionControler class and stems from the lack of proper authorization controls before allowing access to certain functionality (ZDI Advisory).

The vulnerability allows low-privileged authenticated users to escalate their privileges to Admin level by chaining the SSRF vulnerability with an Improper Access Control vulnerability. This could lead to unauthorized access to protected resources and potential system compromise (NVD).

The vulnerability requires authentication to exploit, with a network attack vector and low attack complexity. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to escalate privileges to resources normally protected from the user (ZDI Advisory).

Progress Software has released version 2023.1.3 of WhatsUp Gold to address this vulnerability. Users are advised to upgrade to this version or later to mitigate the risk (ZDI Advisory).