First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-5014

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Progress Software Corporation	WhatsUp Gold	>= 2023.1.0, < 2023.1.3
progress	whatsup_gold	>= 2023.1.0, < 2023.1.3

References

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-501405.5In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in task_tick_mm_cid() With KASAN a CVE-2024-501415.5In the Linux kernel, the following vulnerability has been resolved: ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context P CVE-2024-501425.5In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is un CVE-2024-501437.8In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow wh CVE-2024-501445.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix unbalanced rpm put() with fence_fini() Currently we can ca CVE-2024-501455.5In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Add SKB allocation failures handling in __octep_oq_process_r CVE-2024-501465.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't call cleanup on profile rollback failure When profile CVE-2024-501475.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command bitmask initialization Command bitmask have a de CVE-2024-501485.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in proto_unregister There's is CVE-2024-501495.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't free job in TDR Freeing job in TDR is not safe as TDR ca CVE-2024-50158.8In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Upda CVE-2024-501507.8In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device

CVE-2024-5014: Medium severity, CVSS 6.5 | Vulnix