CVE-2024-5010 is a high severity (CVSS 7.5) information disclosure in Progress WhatsUp Gold before 2023.1.3. A specially crafted unauthenticated HTTP request to the TestController can disclose sensitive information. Upgrade to 2023.1.3 or later, and keep the web console off untrusted networks.
What's affected
Progress WhatsUp Gold versions released before 2023.1.3. The record points at the TestController functionality and says no authentication is required. A Talos Intelligence report is listed among the references (TALOS-2024-1933), which I did not retrieve.
The record does not name a separate fixed build, but its wording means 2023.1.3 or later is outside the affected range. Confirm the exact fixed build and any hotfix steps in the Progress June 2024 security bulletin, which I could not load for this review.
The weakness class is CWE-200, exposure of sensitive information to an unauthorized actor. The record scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
How to check if you're exposed
WhatsUp Gold is a Windows application, so the check is a version check. Open the product's About information in the console, or look at the installed version in Windows Apps and Features, and compare it with 2023.1.3. Anything older is in the affected range.
Then check reachability. Note whether the web console is exposed to the internet or to wide internal networks, and who holds accounts on it. Because no login is needed, anyone who can reach the web port is in scope. Check firewall rules and any reverse proxy in front of the console.
What to do now
- Upgrade to WhatsUp Gold 2023.1.3 or later.
- Limit the console's network exposure to administrators and monitoring staff.
- Read the Progress bulletin and the Talos report for what information is exposed, then decide what to rotate.
- Search web logs for requests to test endpoints from unfamiliar addresses.
- Rotate secrets the console could hold if logs suggest outside access.
Why it matters
Test and diagnostic controllers are meant for developers and often ship without the same checks as the rest of the application. A request that needs no login and returns data it should not is an exposure of sensitive information to an unauthorized actor, CWE-200.
The record does not say what data is returned, so I will not guess. Given that monitoring tools hold network maps and sometimes credentials, assume the worst when deciding what to rotate. The record does not mark it as exploited.
Quick check
What information leaks?
The record only says sensitive information. Read the Talos report and the Progress bulletin for specifics before deciding which secrets to rotate.
Sources
- Progress WhatsUp Gold Security Bulletin, June 2024 (linked from the record; the page would not load for me, so the version statements here come from the NVD record)
Last reviewed: 19 October 2026.
