CVE-2024-6671

In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.

In Progress WhatsUp Gold before version 21.1.0, an application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.

WhatsUp Gold before version 2026.0.2 has a vulnerability allowing an unauthenticated remote attacker to execute arbitrary code in the context of the IIS application service account.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.

WhatsUp Gold before version 2026.0.2 has a vulnerability allowing an authenticated attacker to bypass frontend controls and inject persistent script content.

In Progress WhatsUp Gold before version 23.0.0 has an SNMP-related application endpoint that fails to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, known as XSS.