CVE-2024-6670

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024	Vendor Advisory
https://www.progress.com/network-monitoring	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*

History

04 Sep 2024, 14:23

Type	Values Removed	Values Added
Summary		(es) En las versiones de WhatsUp Gold lanzadas antes de 2024.0.0, una vulnerabilidad de inyección SQL permite que un atacante no autenticado recupere la contraseña cifrada del usuario.
References	~~() https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 -~~	() https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 - Vendor Advisory
References	~~() https://www.progress.com/network-monitoring -~~	() https://www.progress.com/network-monitoring - Product
First Time		Progress Progress whatsup Gold
CPE		cpe:2.3:a:progress:whatsup_gold::::::::

29 Aug 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-29 22:15

Updated : 2024-09-17 01:00

NVD link : CVE-2024-6670

Mitre link : CVE-2024-6670

CVE.ORG link : CVE-2024-6670

JSON object : View

Products Affected

progress

whatsup_gold

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-6670", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-08-29T22:15:05.573", "references": [{"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024", "tags": ["Vendor Advisory"], "source": "security@progress.com"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "In WhatsUp Gold versions released before 2024.0.0,\u00a0a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password."}, {"lang": "es", "value": "En las versiones de WhatsUp Gold lanzadas antes de 2024.0.0, una vulnerabilidad de inyecci\u00f3n SQL permite que un atacante no autenticado recupere la contrase\u00f1a cifrada del usuario."}], "lastModified": "2024-09-17T01:00:01.320", "cisaActionDue": "2024-10-07", "cisaExploitAdd": "2024-09-16", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F88DF254-746E-41F3-A2CA-0DC0B5C49837", "versionEndExcluding": "24.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com", "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "Progress WhatsUp Gold SQL Injection Vulnerability"}