What’s Vulnerable › Vulnerabilities

CVE-2024-2449: LoadMaster Cross-Site Request Forgery (CSRF)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-22 · updated 2026-06-17
• Weakness: CWE-352

Description

A cross-site request forgery vulnerability has been identified in LoadMaster.  It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF payload hosted on the malicious site would execute HTTP transactions on behalf of the LoadMaster administrator.

Affected products

• Progress Software LoadMaster: from 7.2.49.0 before 7.2.54.9; from 7.2.55.0 before 7.2.59.3; 7.1.35.10, 7.2.48.10 — fixed in 7.2.54.9, 7.2.59.3

How to fix

Upgrade to a fixed version: Progress Software LoadMaster 7.2.54.9, 7.2.59.3. Check the vendor advisory for mitigations.

References

• https://progress.com/loadmaster
• https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449
• https://progress.com/loadmaster
• https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449

Get alerted when CVE-2024-2449 or the next vulnerability affects your stack