CVE-2024-5009
HIGHWhatsUp Gold < 23.1.3 - Improper Access Control in InstallController.SetAdminPassword
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-5009. PoCs published by sinsinology, th3gokul.
AI-analyzed exploit summary The repository contains a functional exploit for CVE-2024-5009, which allows privilege escalation in Progress WhatsUp Gold by changing the administrator password via an unauthenticated HTTP POST request to the SetAdminPassword endpoint.
Description
In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.
Exploits (2)
The repository contains a functional exploit for CVE-2024-5009, which allows privilege escalation in Progress WhatsUp Gold by changing the administrator password via an unauthenticated HTTP POST request to the SetAdminPassword endpoint.
The repository contains a functional exploit for CVE-2024-5009, a privilege escalation vulnerability in WhatsUp Gold. The exploit sends a crafted POST request to the SetAdminPassword endpoint to change the admin password, demonstrating the vulnerability.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H