CVE-2024-5011 is a high severity (CVSS 7.5) denial of service in Progress WhatsUp Gold before 2023.1.3. A specially crafted unauthenticated request to the TestController Chart function leads to uncontrolled resource consumption. Upgrade to 2023.1.3 or later and restrict who can reach the console.
What's affected
Progress WhatsUp Gold versions released before 2023.1.3. The component is the Chart functionality of the TestController, and the record says no login is needed. The Talos report TALOS-2024-1933 is listed in the references.
The record does not name a separate fixed build, but its wording means 2023.1.3 or later is outside the affected range. Confirm the exact fixed build and any hotfix steps in the Progress June 2024 security bulletin, which I could not load for this review.
The weakness class is CWE-400, uncontrolled resource consumption. The record scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
How to check if you're exposed
WhatsUp Gold is a Windows application, so the check is a version check. Open the product's About information in the console, or look at the installed version in Windows Apps and Features, and compare it with 2023.1.3. Anything older is in the affected range.
Then check reachability. Note whether the web console is exposed to the internet or to wide internal networks, and who holds accounts on it. Watch for symptoms in the past weeks: console slowdowns, application pool restarts, or CPU and memory spikes that line up with odd web requests.
What to do now
- Upgrade to 2023.1.3 or later.
- Put the console behind a firewall rule or reverse proxy that limits source addresses.
- Alert on sustained CPU or memory use by the console's web process.
- Make sure your monitoring of the monitor works: a second system should notice when WhatsUp Gold stops answering.
- Review the Progress bulletin for related fixes in the same release.
Why it matters
Uncontrolled resource consumption, CWE-400, means a request can make the server spend far more work than the request deserves. No data is stolen here. The harm is availability, and for a monitoring product that means a blind spot exactly when somebody wants to cause trouble elsewhere.
It shares the TestController with CVE-2024-5010, and that is a useful clue: one badly protected controller produced both a disclosure and a denial of service. Not a KEV entry per the record.
Try it yourself
Monitoring only helps if it keeps running and keeps re-checking. This demo shows how continuous monitoring re-scans as new CVEs are published.
Click through it at your own pace, or open it full screen.
Quick check
Is availability loss a big deal for a monitoring tool?
It can be. If the tool is down, alerts stop. Make sure a second path notices when the monitor itself fails.
Sources
- Progress WhatsUp Gold Security Bulletin, June 2024 (linked from the record; the page would not load for me, so the version statements here come from the NVD record)
Last reviewed: 19 October 2026.
