CVE-2024-2448

HIGH

LoadMaster - Command Injection

Title source: llm

Description

An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.

References (2)

[Broken Link] https://progress.com/loadmaster

[Release Notes] https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449

Scores

CVSS v3 8.4

EPSS 0.2271

EPSS Percentile 95.8%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Classification

CWE

CWE-78

Status published

Affected Products (4)

progress/loadmaster < 7.2.54.9

progress/loadmaster < 7.2.59.3

progress/loadmaster

Timeline

Published Mar 22, 2024

Tracked Since Feb 18, 2026