Critical Path Traversal Vulnerability in Progress WhatsUp Gold

What changed

A critical vulnerability has been discovered in Progress WhatsUp Gold, specifically in versions released before 2023.1.3. This flaw enables unauthenticated remote code execution through the WhatsUp.ExportUtilities.Export.GetFileWithoutZip function.

The vulnerability allows attackers to execute commands with iisapppool\nmconsole privileges, posing a serious risk to the integrity and security of affected systems.

Who is affected

Organizations utilizing Progress WhatsUp Gold versions prior to 2023.1.3 are at risk due to this vulnerability. The following groups are particularly vulnerable:

IT departments managing network monitoring solutions should be aware of this issue to mitigate potential threats.

• Progress WhatsUp Gold users on versions before 2023.1.3
• Network administrators relying on WhatsUp Gold for monitoring
• Organizations with exposed systems that utilize this software

What to do

It is crucial for affected organizations to take immediate action to protect their systems. Upgrading to the latest version of WhatsUp Gold is highly recommended to mitigate this vulnerability.

Additionally, organizations should review their security policies and ensure that proper access controls are in place to limit exposure to such vulnerabilities.

• Upgrade to Progress WhatsUp Gold version 2023.1.3 or later
• Implement strict access controls to limit exposure
• Conduct a security audit to identify potential vulnerabilities