CVE-2024-5017: 
WhatsUp Gold vulnerability analysis and mitigation

CVE-2024-5017 is a path traversal vulnerability discovered in Progress Software Corporation's WhatsUp Gold versions prior to 2023.1.3. The vulnerability allows an authenticated user to make specially crafted HTTP requests to the AppProfileImport functionality, potentially leading to information disclosure (Talos Intelligence, NVD).

The vulnerability exists in the AppProfileImport functionality of WhatsUp Gold. The issue stems from improper path validation in the getPath function where the fileName argument is directly controlled by the attacker and used in File.Exists function without proper path traversal protection. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with low attack complexity and requiring low privileges (Talos Intelligence).

If successfully exploited, this vulnerability could allow an authenticated attacker to conduct path traversal attacks and check the existence of any file within the file system, potentially leading to unauthorized information disclosure (NVD, Talos Intelligence).

Users are advised to upgrade to WhatsUp Gold version 2023.1.3 or later, which contains fixes for this vulnerability (Progress Advisory).

The vulnerability was discovered by Marcin 'Icewall' Noga of Cisco Talos, and was responsibly disclosed to Progress Software Corporation on February 7, 2024. The vendor released patches on June 25, 2024, followed by public disclosure on June 26, 2024 (Talos Intelligence).