CVE-2024-4561 – WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController

https://notcve.org/view.php?id=CVE-2024-4561

In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.2, existe una vulnerabilidad SSRF ciega en FaviconController de Whatsup Gold que permite a un atacante enviar solicitudes HTTP arbitrarias en nombre del servidor vulnerable. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Progress Software WhatsUp Gold. Authentication is required to exploit this vulnerability. The specific flaw exists within the FaviconController class. The issue results from following HTTP redirects. • https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2 https://www.progress.com/network-monitoring • CWE-918: Server-Side Request Forgery (SSRF) •