CVE-2024-46906

CVE-2024-46906 is a SQL injection flaw (CWE-89) in Progress WhatsUp Gold versions released before 2024.0.1. An attacker who already holds an account with at least Report Viewer permissions can send crafted input over the network to the monitoring application's database layer, allowing low-complexity exploitation with no user interaction. Successful abuse escalates the low-privileged user to the admin account, granting full control over the WhatsUp Gold console with high impact to confidentiality, integrity, and availability. Any organization running an unpatched WhatsUp Gold release prior to 2024.0.1 is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, but the EPSS score of 40.4% (99th percentile) indicates a high probability of exploitation within 30 days; the fix shipped in WhatsUp Gold 2024.0.1 alongside a batch of other WhatsUp Gold patches from Progress.

What to do: Upgrade to WhatsUp Gold 2024.0.1 or later, which also addresses the other recently patched WhatsUp Gold flaws. Until patched, limit and review accounts holding Report Viewer or higher permissions, and monitor the WhatsUp Gold server for anomalous database queries or unexpected admin account activity. Check your installed version and confirm the 2024.0.1 update is applied, since exploitation risk is rated high (EPSS 40.4%) even though exploitation has not yet been confirmed.