CVE-2024-2449: A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or…

PriorityP349high7.5CVSS 3.1

AVNACHPRNUIRSUCHIHAH

EPSS

12.88%

95.8th percentile

A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
progress	loadmaster	—	—
progress	loadmaster	—	—
progress	loadmaster	>= 7.2.49.0 < 7.2.54.9	7.2.54.9
progress	loadmaster	>= 7.2.55.0 < 7.2.59.3	7.2.59.3
progress_software	loadmaster	>= 7.1.35.10 < 7.1.35.11 (LoadMaster MT)	7.1.35.11 (LoadMaster MT)
progress_software	loadmaster	>= 7.2.48.10 < 7.2.48.11 (LoadMaster LTS)	7.2.48.11 (LoadMaster LTS)
progress_software	loadmaster	>= 7.2.49.0 < 7.2.54.9 ( LoadMaster LTSF)	7.2.54.9 ( LoadMaster LTSF)
progress_software	loadmaster	>= 7.2.55.0 < 7.2.59.3 ( LoadMaster GA)	7.2.59.3 ( LoadMaster GA)

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.