CVE-2024-2448: LoadMaster Command Injection Vulnerability

High severity · published Mar 22, 2024

CVE-2024-2448

LoadMaster Command Injection Vulnerability

8.8

CVSS

55.4%

EPSS

On KEV

Description

An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)55.4% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

LoadMaster · Progress Software

7.2.55.0 before 7.2.59.3 ( LoadMaster GA); 7.2.49.0 before 7.2.54.9 ( LoadMaster LTSF); 7.2.48.10 before 7.2.48.11 (LoadMaster LTS); 7.1.35.10 before 7.1.35.11 (LoadMaster MT) · source: vendor, NVD, CISA

Affected product

LoadMaster

Progress Software

All LoadMaster CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-2448

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-2448

Broken Link

https://progress.com/loadmaster

Release Notes

https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449