CVE-2024-4885

Timeline

Detection, updates, and resolution for this record.

1. Jun 25, 2024 · Catalog

   Detected

   In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

2. Mar 3, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Mar 24, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

Affected

• cpe progress/whatsup goldversion unspecified
• vendor Progress WhatsUp Goldversion unspecified

Sources

• CISA KEVCVE-2024-4885

  Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.

  cisa.gov
• CVE.orgCVE-2024-4885

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2024-4885

  30-day exploitation probability 99.3%

  first.org
• NIST NVDCVE-2024-4885

  In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

  nvd.nist.gov

References

• CISA note · community.progress.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Product · progress.com