CVE-2024-5008 is a high severity (CVSS 8.8) flaw in Progress WhatsUp Gold before 2023.1.3. An authenticated user with certain permissions can upload an arbitrary file and obtain remote code execution. Upgrade to 2023.1.3 or later and review who holds those permissions.
What's affected
Progress WhatsUp Gold versions released before 2023.1.3. The record names the AppProfileImportController in the application performance monitoring area as the component, and says the user needs an account with certain permissions. It is not an unauthenticated flaw.
The record does not name a separate fixed build, but its wording means 2023.1.3 or later is outside the affected range. Confirm the exact fixed build and any hotfix steps in the Progress June 2024 security bulletin, which I could not load for this review.
The weakness class is CWE-434, unrestricted upload of file with dangerous type. The record scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
WhatsUp Gold is a Windows application, so the check is a version check. Open the product's About information in the console, or look at the installed version in Windows Apps and Features, and compare it with 2023.1.3. Anything older is in the affected range.
Then check reachability. Note whether the web console is exposed to the internet or to wide internal networks, and who holds accounts on it. This one needs a logged-in user, so list the accounts that can import application profiles and ask whether each still needs that right.
What to do now
- Upgrade to WhatsUp Gold 2023.1.3 or later after reading the Progress bulletin.
- Review which accounts have permission to import application monitoring profiles and remove the right where it is not needed.
- Check the server for unexpected files in application directories and unexpected child processes from the web service.
- Restrict console access to a management network.
- Rotate credentials stored in the product if you find signs of misuse.
Why it matters
Arbitrary file upload that ends in code execution is a recurring pattern in management consoles. The upload feature exists for a good reason, importing a profile, but the code does not limit what a file can be or where it lands. The class is CWE-434 in the record.
Because a monitoring server usually holds credentials for the systems it watches, a foothold on it reaches further than the host itself. The record does not flag this CVE as a KEV entry, and I found no advisory saying it is exploited.
Quick check
Does an attacker need to be logged in?
Yes. The record says an authenticated user with certain permissions. That lowers exposure compared with an anonymous flaw but not for shared or weakly protected accounts.
Sources
- Progress WhatsUp Gold Security Bulletin, June 2024 (linked from the record; the page would not load for me, so the version statements here come from the NVD record)
Last reviewed: 19 October 2026.
