{"id":"CVE-2024-4883","published":"2024-06-25T19:44:42Z","modified":"2024-08-01T20:55:10Z","title":"WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability","vendor":"Progress Software Corporation","product":"WhatsUp Gold","tier":"core","eol":null,"affectedVersions":[{"vendor":"Progress Software Corporation","product":"WhatsUp Gold","versions":[">= 2023.1.0, < 2023.1.3"]}],"description":{"text":"In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.","provenance":"source","from":"CVE.org"},"summary":{"text":"The WriteDataFile directory traversal flaw in Progress Software's WhatsUp Gold network monitoring product lives in the NmApi.exe component. An unauthenticated attacker with network access to the affected WhatsUp Gold instance can achieve remote code execution as the service account, requiring no credentials and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:24Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.64535,"percentile":0.99236,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://www.progress.com/network-monitoring","tags":["product"]},{"url":"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-44453","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44453","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-07-08","earliestUrl":"https://github.com/sinsinology/CVE-2024-4883","repos":[{"name":"sinsinology/CVE-2024-4883","url":"https://github.com/sinsinology/CVE-2024-4883","stars":11,"created":"2024-07-08"}]},"first":{"date":"2024-07-08","source":"PoC-in-GitHub","url":"https://github.com/sinsinology/CVE-2024-4883"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-06-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-4883","provenance":"source"},{"date":"2024-07-08","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sinsinology/CVE-2024-4883","provenance":"source"}],"speed":{"daysToPublicExploit":13,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9924"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}