CVE-2024-2448

HIGH

LoadMaster 7.2.49.0-7.2.54.8 and 7.2.55.0-7.2.59.2 - Authenticated OS Command Injection via UI Component

Title source: llm

Description

An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.

References (2)

Core 2

Core References

Broken Link product

https://progress.com/loadmaster

Release Notes vendor-advisory

https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449

Scores

CVSS v3 8.4

EPSS 0.4475

EPSS Percentile 97.6%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (4)

progress/loadmaster 7.1.35.10

progress/loadmaster 7.2.48.10

progress/loadmaster 7.2.49.0 - 7.2.54.9

progress/loadmaster 7.2.55.0 - 7.2.59.3

Published Mar 22, 2024

Tracked Since Feb 18, 2026