{"id":"CVE-2024-4885","published":"2024-06-25T20:15:12Z","modified":"2026-06-17T08:03:06Z","title":"Progress WhatsUp Gold Path Traversal Vulnerability","vendor":"Progress","product":"WhatsUp Gold","tier":"core","eol":null,"description":{"text":"In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The \n\nWhatsUp.ExportUtilities.Export.GetFileWithoutZip\n\n\n\n allows execution of commands with iisapppool\\nmconsole privileges.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a path traversal weakness in the GetFileWithoutZip method of the WhatsUp.ExportUtilities.Export component in Progress WhatsUp Gold, affecting versions released before 2023.1.3. An unauthenticated remote attacker with network access can send requests to this component without user interaction, which allows arbitrary command execution with the privileges of the iisapppool\\nmconsole account.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:58Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99288,"percentile":0.99937,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-03-03","dueDate":"2025-03-24","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-4885","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-08-06","exploitedFirstSeen":"2024-08-06","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-06&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-06"},{"url":"https://x.com/Shadowserver/status/1821121075704647731","date":"2024-08-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-08&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-11&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-14&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-19&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-20&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-22&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-25&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-26&host_type=src&vulnerability=cve-2024-4885","date":"2024-08-26"}],"evidenceTotal":429,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024","tags":["Vendor Advisory"]},{"url":"https://www.progress.com/network-monitoring","tags":["Product"]},{"url":"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024","tags":["Vendor Advisory"]},{"url":"https://www.progress.com/network-monitoring","tags":["Product"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4885","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"By sending a crafted payload to a vulnerable WhatsUp Gold server, an attacker can conduct a path traversal attack and write malicious files onto the server. This leads to high-privileged remote code execution.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"By sending a crafted payload to a vulnerable WhatsUp Gold server, an attacker can conduct a path traversal attack and write malicious files onto the server. This leads to high-privileged remote code execution.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-44455","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44455","exploited":true,"exploitedSince":"2025-03-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-07-08","earliestUrl":"https://github.com/sinsinology/CVE-2024-4885","repos":[{"name":"sinsinology/CVE-2024-4885","url":"https://github.com/sinsinology/CVE-2024-4885","stars":17,"created":"2024-07-08"}]},"nuclei":[{"id":"CVE-2024-4885","name":"Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution","severity":"critical","path":"http/cves/2024/CVE-2024-4885.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4885.yaml"}],"first":{"date":"2024-07-08","source":"PoC-in-GitHub","url":"https://github.com/sinsinology/CVE-2024-4885"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2024-06-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4885","provenance":"source"},{"date":"2024-07-08","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sinsinology/CVE-2024-4885","provenance":"source"},{"date":"2024-08-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-06&host_type=src&vulnerability=cve-2024-4885","provenance":"source"},{"date":"2025-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44455","provenance":"source"}],"speed":{"daysToPublicExploit":13,"firstExploitFrom":"PoC-in-GitHub","daysToKev":251},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 815 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}