CVE-2024-4885

WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

Affected

Progress Software Corporation · WhatsUp Gold

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

99.29% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-03-03

Nuclei

critical · CWE-22

Published

2024-06-25

Updated

2025-10-21

Proof-of-concept exploits (1)

• sinsinology/CVE-2024-488517★ · 2024-07-08

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4885.yaml

Security advisories

• https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
• https://www.progress.com/network-monitoring

References

• CVE Record
• NVD entry

Related

• CVE-2022-26503
• CVE-2023-20887
• CVE-2023-34039
• CVE-2024-29847
• CVE-2024-29849
• CVE-2024-29855