Vulnerability-Lookup

CVE-2024-2449 (GCVE-0-2024-2449)

Vulnerability from cvelistv5 – Published: 2024-03-22 13:35 – Updated: 2024-08-12 19:23

Title

LoadMaster Cross-Site Request Forgery (CSRF)

Summary

A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-22 14:59 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 133 records in the last 180 days details

References

2 references

URL	Tags
https://progress.com/loadmaster	product
https://support.kemptechnologies.com/hc/en-us/art…	vendor-advisory

Impacted products

5 products

Vendor	Product	Version	CPE status
Progress Software	LoadMaster	Affected: 7.2.55.0 , < 7.2.59.3 ( LoadMaster GA) (semver) Affected: 7.2.49.0 , < 7.2.54.9 ( LoadMaster LTSF) (semver) Affected: 7.2.48.10 , < 7.2.48.11 (LoadMaster LTS) (semver) Affected: 7.1.35.10 , < 7.1.35.11 (LoadMaster MT) (semver)	guessed
kemptechnologies	loadmaster	Affected: 7.2.55.0 , < 7.2.59.3 (custom) cpe:2.3:a:kemptechnologies:loadmaster::::::::
progress	loadmaster	Affected: 7.2.48.10 , < 7.2.48.11 (custom) cpe:2.3:a:progress:loadmaster:::::lts:::*
progress	loadmaster	Affected: 7.2.49.0 , < 7.2.54.9 (custom) cpe:2.3:a:progress:loadmaster:::::ltsf:::*
progress	loadmaster	Affected: 7.1.35.10 , < 7.1.35.11 (custom) cpe:2.3:a:progress:loadmaster:::::ml:::*

Credits

Rhino Security Labs - David Yesland

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T19:11:53.568Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://progress.com/loadmaster"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "loadmaster",
            "vendor": "kemptechnologies",
            "versions": [
              {
                "lessThan": "7.2.59.3",
                "status": "affected",
                "version": "7.2.55.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:progress:loadmaster:*:*:*:*:lts:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "loadmaster",
            "vendor": "progress",
            "versions": [
              {
                "lessThan": "7.2.48.11",
                "status": "affected",
                "version": "7.2.48.10",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "loadmaster",
            "vendor": "progress",
            "versions": [
              {
                "lessThan": "7.2.54.9",
                "status": "affected",
                "version": "7.2.49.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:progress:loadmaster:*:*:*:*:ml:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "loadmaster",
            "vendor": "progress",
            "versions": [
              {
                "lessThan": "7.1.35.11",
                "status": "affected",
                "version": "7.1.35.10",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-2449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-22T14:59:39.862131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-12T19:23:36.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "LoadMaster",
            "Multi-Tenancy",
            "ECS Connection Manager",
            "LM 360 Connector"
          ],
          "product": "LoadMaster",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "7.2.59.3 ( LoadMaster GA)",
              "status": "affected",
              "version": "7.2.55.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.54.9 ( LoadMaster LTSF)",
              "status": "affected",
              "version": "7.2.49.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.48.11 (LoadMaster LTS)",
              "status": "affected",
              "version": "7.2.48.10",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.35.11 (LoadMaster MT)",
              "status": "affected",
              "version": "7.1.35.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Rhino Security Labs - David Yesland"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u0026nbsp; It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
            }
          ],
          "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-22T13:35:39.103Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://progress.com/loadmaster"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "LoadMaster Cross-Site Request Forgery (CSRF)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2024-2449",
    "datePublished": "2024-03-22T13:35:39.103Z",
    "dateReserved": "2024-03-14T12:32:14.175Z",
    "dateUpdated": "2024-08-12T19:23:36.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-2449",
      "date": "2026-10-14",
      "epss": "0.1288",
      "percentile": "0.96254"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
        },
        {
          "lang": "es",
          "value": "Se ha identificado una vulnerabilidad de Cross-Site Request Forgery en LoadMaster. Es posible que un actor malintencionado, que tenga conocimiento previo de la IP o el nombre de host de un LoadMaster espec\u00edfico, dirija a un administrador de LoadMaster autenticado a un sitio de terceros. En tal escenario, el payload CSRF alojado en el sitio malicioso ejecutar\u00eda transacciones HTTP en nombre del administrador de LoadMaster."
        }
      ],
      "id": "CVE-2024-2449",
      "lastModified": "2024-11-21T09:09:46.640",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.6,
            "impactScore": 5.9,
            "source": "security@progress.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-03-22T14:15:09.210",
      "references": [
        {
          "source": "security@progress.com",
          "url": "https://progress.com/loadmaster"
        },
        {
          "source": "security@progress.com",
          "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://progress.com/loadmaster"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
        }
      ],
      "sourceIdentifier": "security@progress.com",
      "vulnStatus": "Undergoing Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-352"
            }
          ],
          "source": "security@progress.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "affected",
                "modules": [
                  "LoadMaster",
                  "Multi-Tenancy",
                  "ECS Connection Manager",
                  "LM 360 Connector"
                ],
                "product": "LoadMaster",
                "vendor": "Progress Software",
                "versions": [
                  {
                    "lessThan": "7.2.59.3 ( LoadMaster GA)",
                    "status": "affected",
                    "version": "7.2.55.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.2.54.9 ( LoadMaster LTSF)",
                    "status": "affected",
                    "version": "7.2.49.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.2.48.11 (LoadMaster LTS)",
                    "status": "affected",
                    "version": "7.2.48.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.1.35.11 (LoadMaster MT)",
                    "status": "affected",
                    "version": "7.1.35.10",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@progress.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "loadmaster",
                "vendor": "kemptechnologies",
                "versions": [
                  {
                    "lessThan": "7.2.59.3",
                    "status": "affected",
                    "version": "7.2.55.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:progress:loadmaster:*:*:*:*:lts:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "loadmaster",
                "vendor": "progress",
                "versions": [
                  {
                    "lessThan": "7.2.48.11",
                    "status": "affected",
                    "version": "7.2.48.10",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "loadmaster",
                "vendor": "progress",
                "versions": [
                  {
                    "lessThan": "7.2.54.9",
                    "status": "affected",
                    "version": "7.2.49.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:progress:loadmaster:*:*:*:*:ml:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "loadmaster",
                "vendor": "progress",
                "versions": [
                  {
                    "lessThan": "7.1.35.11",
                    "status": "affected",
                    "version": "7.1.35.10",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*",
                    "matchCriteriaId": "09E601FC-0D63-44B7-8726-DA512D075139",
                    "versionEndExcluding": "7.2.54.9",
                    "versionStartIncluding": "7.2.49.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*",
                    "matchCriteriaId": "F95CC892-C725-49BE-AC30-3AB2C1547517",
                    "versionEndExcluding": "7.2.59.3",
                    "versionStartIncluding": "7.2.55.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:progress:loadmaster:7.1.35.10:*:*:*:mt:*:*:*",
                    "matchCriteriaId": "8F615B26-D735-4A95-9D04-D434B61CFB38",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:progress:loadmaster:7.2.48.10:*:*:*:lts:*:*:*",
                    "matchCriteriaId": "8DDDA906-6A2C-4662-B3EC-6406BC32370D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
          },
          {
            "lang": "es",
            "value": "Se ha identificado una vulnerabilidad de Cross-Site Request Forgery en LoadMaster. Es posible que un actor malintencionado, que tenga conocimiento previo de la IP o el nombre de host de un LoadMaster espec\u00edfico, dirija a un administrador de LoadMaster autenticado a un sitio de terceros. En tal escenario, el payload CSRF alojado en el sitio malicioso ejecutar\u00eda transacciones HTTP en nombre del administrador de LoadMaster."
          }
        ],
        "id": "CVE-2024-2449",
        "lastModified": "2026-06-17T07:24:33.527",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "security@progress.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-2449",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-22T14:59:39.862131Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-22T14:15:09.210",
        "references": [
          {
            "source": "security@progress.com",
            "tags": [
              "Broken Link"
            ],
            "url": "https://progress.com/loadmaster"
          },
          {
            "source": "security@progress.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Broken Link"
            ],
            "url": "https://progress.com/loadmaster"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
          }
        ],
        "sourceIdentifier": "security@progress.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security@progress.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:09:56+00:00",
      "cve": "CVE-2024-2449",
      "id": "CVE-2024-2449",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "LoadMaster Cross-Site Request Forgery (CSRF)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-2449.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T19:11:53.568Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "product",
                  "x_transferred"
                ],
                "url": "https://progress.com/loadmaster"
              },
              {
                "tags": [
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "loadmaster",
                "vendor": "kemptechnologies",
                "versions": [
                  {
                    "lessThan": "7.2.59.3",
                    "status": "affected",
                    "version": "7.2.55.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:progress:loadmaster:*:*:*:*:lts:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "loadmaster",
                "vendor": "progress",
                "versions": [
                  {
                    "lessThan": "7.2.48.11",
                    "status": "affected",
                    "version": "7.2.48.10",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "loadmaster",
                "vendor": "progress",
                "versions": [
                  {
                    "lessThan": "7.2.54.9",
                    "status": "affected",
                    "version": "7.2.49.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:progress:loadmaster:*:*:*:*:ml:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "loadmaster",
                "vendor": "progress",
                "versions": [
                  {
                    "lessThan": "7.1.35.11",
                    "status": "affected",
                    "version": "7.1.35.10",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-2449",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-03-22T14:59:39.862131Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-12T19:23:15.865Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "modules": [
                "LoadMaster",
                "Multi-Tenancy",
                "ECS Connection Manager",
                "LM 360 Connector"
              ],
              "product": "LoadMaster",
              "vendor": "Progress Software",
              "versions": [
                {
                  "lessThan": "7.2.59.3 ( LoadMaster GA)",
                  "status": "affected",
                  "version": "7.2.55.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "7.2.54.9 ( LoadMaster LTSF)",
                  "status": "affected",
                  "version": "7.2.49.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "7.2.48.11 (LoadMaster LTS)",
                  "status": "affected",
                  "version": "7.2.48.10",
                  "versionType": "semver"
                },
                {
                  "lessThan": "7.1.35.11 (LoadMaster MT)",
                  "status": "affected",
                  "version": "7.1.35.10",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Rhino Security Labs - David Yesland"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u0026nbsp; It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
                }
              ],
              "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-62",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-62 Cross Site Request Forgery"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-03-22T13:35:39.103Z",
            "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
            "shortName": "ProgressSoftware"
          },
          "references": [
            {
              "tags": [
                "product"
              ],
              "url": "https://progress.com/loadmaster"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "LoadMaster Cross-Site Request Forgery (CSRF)",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "assignerShortName": "ProgressSoftware",
        "cveId": "CVE-2024-2449",
        "datePublished": "2024-03-22T13:35:39.103Z",
        "dateReserved": "2024-03-14T12:32:14.175Z",
        "dateUpdated": "2024-08-12T19:23:36.632Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2024-03540 (CVE-2024-2449)

Vulnerability from fstec – Published: 2024-05-07 – Updated: 2024-05-07 – View on bdu.fstec.ru Fixed

Title

Уязвимость платформы для развертывания и управления приложениями LoadMaster, связанная с подделкой межсайтовых запросов, позволяющая нарушителю осуществить CSRF-атаку

Summary

Уязвимость платформы для развертывания и управления приложениями LoadMaster связана с подделкой межсайтовых запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, осуществить CSRF-атаку с помощью специально созданных HTTP-запросов

Severity

7.6 (High) CVSS 2.0


                      
                        AV:N/AC:H/Au:N/C:C/I:C/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Spoofing

Incidents

Being clarified

Remediation

Software update

CWE

CWE-352 - Межсайтовая фальсификация запросов

Aliases

CVE-2024-2449

References

1 reference

URL
https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaste…

Impacted products

1 product from 1 vendor

Vendors

Progress Software Corporation

Products

LoadMaster

Versions

до 7.2.48.11 (LTS) (LoadMaster), до 7.1.35.11 (MT) (LoadMaster), от 7.2.49.0 до 7.2.54.9 (LTSF) (LoadMaster), от 7.2.55.0 до 7.2.59.3 (GA) (LoadMaster)

Product types

Application software

Mitigations

Использование рекомендаций производителя: https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Progress Software Corporation",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 7.2.48.11 (LTS) (LoadMaster), \u0434\u043e 7.1.35.11 (MT) (LoadMaster), \u043e\u0442 7.2.49.0 \u0434\u043e 7.2.54.9 (LTSF) (LoadMaster), \u043e\u0442 7.2.55.0 \u0434\u043e 7.2.59.3 (GA) (LoadMaster)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "22.03.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "07.05.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "07.05.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-03540",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-2449",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "LoadMaster",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 LoadMaster, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u043e\u0439 \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c CSRF-\u0430\u0442\u0430\u043a\u0443",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u0430\u044f \u0444\u0430\u043b\u044c\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 (CWE-352)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 LoadMaster \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u043e\u0439 \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c CSRF-\u0430\u0442\u0430\u043a\u0443 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-352",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

FKIE_CVE-2024-2449

Vulnerability from fkie_nvd - Published: 2024-03-22 14:15 - Updated: 2026-06-17 07:24

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security@progress.com	https://progress.com/loadmaster	Broken Link
security@progress.com	https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://progress.com/loadmaster	Broken Link
af854a3a-2127-422b-91ae-364da2661108	https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449	Vendor Advisory

Impacted products

Vendor	Product	Version
progress	loadmaster	*
progress	loadmaster	*
progress	loadmaster	7.1.35.10
progress	loadmaster	7.2.48.10

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "modules": [
            "LoadMaster",
            "Multi-Tenancy",
            "ECS Connection Manager",
            "LM 360 Connector"
          ],
          "product": "LoadMaster",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "7.2.59.3 ( LoadMaster GA)",
              "status": "affected",
              "version": "7.2.55.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.54.9 ( LoadMaster LTSF)",
              "status": "affected",
              "version": "7.2.49.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.48.11 (LoadMaster LTS)",
              "status": "affected",
              "version": "7.2.48.10",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.35.11 (LoadMaster MT)",
              "status": "affected",
              "version": "7.1.35.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@progress.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "loadmaster",
          "vendor": "kemptechnologies",
          "versions": [
            {
              "lessThan": "7.2.59.3",
              "status": "affected",
              "version": "7.2.55.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:progress:loadmaster:*:*:*:*:lts:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "loadmaster",
          "vendor": "progress",
          "versions": [
            {
              "lessThan": "7.2.48.11",
              "status": "affected",
              "version": "7.2.48.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "loadmaster",
          "vendor": "progress",
          "versions": [
            {
              "lessThan": "7.2.54.9",
              "status": "affected",
              "version": "7.2.49.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:progress:loadmaster:*:*:*:*:ml:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "loadmaster",
          "vendor": "progress",
          "versions": [
            {
              "lessThan": "7.1.35.11",
              "status": "affected",
              "version": "7.1.35.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*",
              "matchCriteriaId": "09E601FC-0D63-44B7-8726-DA512D075139",
              "versionEndExcluding": "7.2.54.9",
              "versionStartIncluding": "7.2.49.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*",
              "matchCriteriaId": "F95CC892-C725-49BE-AC30-3AB2C1547517",
              "versionEndExcluding": "7.2.59.3",
              "versionStartIncluding": "7.2.55.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:progress:loadmaster:7.1.35.10:*:*:*:mt:*:*:*",
              "matchCriteriaId": "8F615B26-D735-4A95-9D04-D434B61CFB38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:progress:loadmaster:7.2.48.10:*:*:*:lts:*:*:*",
              "matchCriteriaId": "8DDDA906-6A2C-4662-B3EC-6406BC32370D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad de Cross-Site Request Forgery en LoadMaster. Es posible que un actor malintencionado, que tenga conocimiento previo de la IP o el nombre de host de un LoadMaster espec\u00edfico, dirija a un administrador de LoadMaster autenticado a un sitio de terceros. En tal escenario, el payload CSRF alojado en el sitio malicioso ejecutar\u00eda transacciones HTTP en nombre del administrador de LoadMaster."
    }
  ],
  "id": "CVE-2024-2449",
  "lastModified": "2026-06-17T07:24:33.527",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "security@progress.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-2449",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-03-22T14:59:39.862131Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-03-22T14:15:09.210",
  "references": [
    {
      "source": "security@progress.com",
      "tags": [
        "Broken Link"
      ],
      "url": "https://progress.com/loadmaster"
    },
    {
      "source": "security@progress.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://progress.com/loadmaster"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
    }
  ],
  "sourceIdentifier": "security@progress.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security@progress.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-6XVX-6CWV-53HW

Vulnerability from github – Published: 2024-03-22 15:31 – Updated: 2025-02-10 21:31

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-2449"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-22T14:15:09Z",
    "severity": "HIGH"
  },
  "details": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.",
  "id": "GHSA-6xvx-6cwv-53hw",
  "modified": "2025-02-10T21:31:27Z",
  "published": "2024-03-22T15:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2449"
    },
    {
      "type": "WEB",
      "url": "https://progress.com/loadmaster"
    },
    {
      "type": "WEB",
      "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-2449

Vulnerability from gsd - Updated: 2024-04-02 05:02

Details

Aliases

CVE-2024-2449

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-2449"
      ],
      "details": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.",
      "id": "GSD-2024-2449",
      "modified": "2024-04-02T05:02:53.079094Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@progress.com",
        "ID": "CVE-2024-2449",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "LoadMaster",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "7.2.59.3 ( LoadMaster GA)",
                                "status": "affected",
                                "version": "7.2.55.0",
                                "versionType": "semver"
                              },
                              {
                                "lessThan": "7.2.54.9 ( LoadMaster LTSF)",
                                "status": "affected",
                                "version": "7.2.49.0",
                                "versionType": "semver"
                              },
                              {
                                "lessThan": "7.2.48.11 (LoadMaster LTS)",
                                "status": "affected",
                                "version": "7.2.48.10",
                                "versionType": "semver"
                              },
                              {
                                "lessThan": "7.1.35.11 (LoadMaster MT)",
                                "status": "affected",
                                "version": "7.1.35.10",
                                "versionType": "semver"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Progress Software"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Rhino Security Labs - David Yesland"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-352",
                "lang": "eng",
                "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://progress.com/loadmaster",
            "refsource": "MISC",
            "url": "https://progress.com/loadmaster"
          },
          {
            "name": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449",
            "refsource": "MISC",
            "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "A cross-site request forgery vulnerability has been identified in LoadMaster.\u00a0 It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator."
          }
        ],
        "id": "CVE-2024-2449",
        "lastModified": "2024-03-22T15:34:43.663",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "security@progress.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-03-22T14:15:09.210",
        "references": [
          {
            "source": "security@progress.com",
            "url": "https://progress.com/loadmaster"
          },
          {
            "source": "security@progress.com",
            "url": "https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449"
          }
        ],
        "sourceIdentifier": "security@progress.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security@progress.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

WID-SEC-W-2024-0704

Vulnerability from csaf_certbund - Published: 2024-03-24 23:00 - Updated: 2024-11-18 23:00

Summary

Kemp LoadMaster: Mehrere Schwachstellen

Severity

Hoch

Scope

2 vulnerabilities in this advisory, including CVE-2024-2449.

CVE-2024-2449

Es bestehen mehrere Schwachstellen in Kemp LoadMaster. Dieser Fehler besteht aufgrund eines Cross-Site-Request-Forgery-Problems, das es erlaubt, einen authentifizierten LoadMaster-Administrator auf eine fremde Seite zu leiten und HTTP-Transaktionen auszuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle zur Umgehung von Sicherheitsvorkehrungen nutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-2449 (GCVE-0-2024-2449)

BDU:2024-03540 (CVE-2024-2449)

FKIE_CVE-2024-2449

GHSA-6XVX-6CWV-53HW

GSD-2024-2449

WID-SEC-W-2024-0704

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour