CVE-2024-12108
CriticalCVSS 9.6Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.
Risk Assessment
Unauthorized access to the monitoring server may allow data theft, configuration changes, or further abuse of the compromised system.
Recommendation
Update WhatsUp Gold to version 2024.0.2 or later and restrict access to the public API.
Other vulnerabilities in WhatsUp Gold
See all- CVE-2024-6671Critical
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the user's encrypted password.
- CVE-2024-6670CriticalActively exploited
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
- CVE-2024-4885CriticalActively exploited
In WhatsUp Gold versions before 2023.1.3, an unauthenticated Remote Code Execution vulnerability exists. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip function allows execution of commands with iisapppool\nmconsole privileges.
- CVE-2021-41318Medium
In Progress WhatsUp Gold before version 21.1.0, an application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
- CVE-2026-65941High
WhatsUp Gold before version 2026.0.2 has a vulnerability allowing an unauthenticated remote attacker to execute arbitrary code in the context of the IIS application service account.
- CVE-2026-65940Medium
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.
- CVE-2026-65939Medium
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.
- CVE-2026-65938Medium
In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.
- CVE-2026-65937High
WhatsUp Gold before version 2026.0.2 has a vulnerability allowing an authenticated attacker to bypass frontend controls and inject persistent script content.
- CVE-2023-35759Medium
In Progress WhatsUp Gold before version 23.0.0 has an SNMP-related application endpoint that fails to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, known as XSS.
Original NVD description (English source)
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS