The version of Progress WhatsUp Gold installed on the remote host is prior to 23.1.3. It is, therefore, affected by multiple vulnerabilities as referenced in the 000258130 advisory, including:

  - In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold.
    This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.
    (CVE-2024-4883)

  - In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in     Progress WhatsUpGold. The Apm.UI.Areas.APM.Controllers.CommunityController allows execution of commands with     iisapppool\nmconsole privileges. (CVE-2024-4884)

  - In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in     Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with     iisapppool\nmconsole privileges.  (CVE-2024-4885)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Progress WhatsUp Gold < 23.1.3 Multiple Vulnerabilities (000258130)

critical Nessus Plugin ID 205145

Version 1.2