CVE-2024-5019: 
WhatsUp Gold vulnerability analysis and mitigation

An unauthenticated Arbitrary File Read vulnerability (CVE-2024-5019) was discovered in WhatsUp Gold versions prior to 2023.1.3. The vulnerability specifically exists in the Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS component, affecting the LoadCSSUsingBasePath method implementation (ZDI Advisory, NVD).

The vulnerability stems from improper validation of user-supplied paths in file operations, classified as CWE-22 (Path Traversal). It received a CVSS v3.1 base score of 7.5 (HIGH) from NIST NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Progress Software Corporation assigned a CVSS score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows attackers to read any file with iisapppool\NmConsole privileges, potentially leading to the disclosure of sensitive information in the context of the service account (NVD, ZDI Advisory).

The vulnerability can be exploited remotely by unauthenticated attackers. No user interaction is required for exploitation, making it particularly concerning from a security perspective (ZDI Advisory).

Progress Software has released version 2023.1.3 of WhatsUp Gold to address this vulnerability. Users are advised to upgrade to this version or later to mitigate the risk (Progress Advisory).

The vulnerability was initially reported by Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) on April 24, 2024, and was publicly disclosed on July 3, 2024, following responsible disclosure practices (ZDI Advisory).