CVE-2024-5008CWE-434

WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability

High · published June 25, 2024

CVSS v3.1
8.8
EPSS
17%
Percentile
97.1
In the wild
Unconfirmed
What it is

In WhatsUp Gold versions released before 2023.1.3,

an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.17330 · 97.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-06-25T19:57Z
EPSS history
Timeline
  • 25 JUN 19:57Z
    WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability
    cvelistv5