VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 22, 2024· Updated Jun 17, 2026

CVE-2024-2449

CVE-2024-2449

Description

A cross-site request forgery vulnerability has been identified in LoadMaster.  It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.

Affected products

6
  • Progress (organisation)/Loadmaster4 versions
    cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*+ 3 more
    • cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*range: >=7.2.55.0,<7.2.59.3
    • cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*range: >=7.2.49.0,<7.2.54.9
    • cpe:2.3:a:progress:loadmaster:7.1.35.10:*:*:*:mt:*:*:*
    • cpe:2.3:a:progress:loadmaster:7.2.48.10:*:*:*:lts:*:*:*
  • Kemp/LoadMasterllm-create
  • Process Software/LoadMastercpe-rescue
    Range: 7.2.55.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.