CVE-2024-5015 is a high severity (CVSS 7.1) authenticated server side request forgery in Progress WhatsUp Gold before 2023.1.3. A low privileged user can chain it with an improper access control flaw to escalate to Admin. Upgrade to 2023.1.3 or later.
What's affected
Progress WhatsUp Gold versions released before 2023.1.3. The component is the Update action of SessionController in the Wug area of the web UI. The attacker needs a low-privileged account, and the record says the SSRF is chained with an improper access control issue.
The record does not name a separate fixed build, but its wording means 2023.1.3 or later is outside the affected range. Confirm the exact fixed build and any hotfix steps in the Progress June 2024 security bulletin, which I could not load for this review.
The weakness class is CWE-918, server side request forgery. The record scores it 7.1 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
How to check if you're exposed
WhatsUp Gold is a Windows application, so the check is a version check. Open the product's About information in the console, or look at the installed version in Windows Apps and Features, and compare it with 2023.1.3. Anything older is in the affected range.
Then check reachability. Note whether the web console is exposed to the internet or to wide internal networks, and who holds accounts on it. Because this is a privilege escalation, list every account on the console, especially read-only and helpdesk accounts, and who owns each.
What to do now
- Upgrade to 2023.1.3 or later.
- Audit console accounts and delete unused low-privilege users.
- Review admin-level changes in the audit trail for anything nobody on the team made.
- Limit outbound connections from the WhatsUp Gold server to the destinations it needs, which reduces what a forged request can reach.
- Put the console behind a VPN or management network.
Why it matters
Server side request forgery, CWE-918, turns the server into a proxy for requests the attacker could not make directly. By itself it often reads internal resources. Chained with a second flaw it becomes an escalation path, which is what the record describes.
The practical defence besides patching is egress control. A monitoring server needs to reach many things, but not everything. The record does not mark this CVE as KEV.
Try it yourself
Chains like this are why severity alone is a poor ordering. This demo shows how an exploitability check changes which findings come first.
Click through it at your own pace, or open it full screen.
Quick check
Why is a low-privilege flaw rated high?
Because it chains into administrator access. The impact of a chain is judged by where it ends, not where it starts.
Sources
- Progress WhatsUp Gold Security Bulletin, June 2024 (linked from the record; the page would not load for me, so the version statements here come from the NVD record)
Last reviewed: 19 October 2026.
