vulnerability

Progress WhatsUp Gold: CVE-2022-29848: Server-Side Request Forgery (SSRF)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:S/C:P/I:N/A:N)

Published

May 11, 2022

Added

Jul 9, 2025

Modified

Mar 25, 2026

Description

In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read sensitive operating-system attributes from a host that is accessible by the WhatsUp Gold system.

Solution

progress-whatsup-gold-upgrade-latest

References

CWE-918
CVE-2022-29848
https://attackerkb.com/topics/CVE-2022-29848
https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022
https://www.progress.com/network-monitoring
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34166

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report