CVE-2024-6670criticalunder attackransomwareCWE-89

CVE-2024-6670: critical vulnerability in Progress Software Corporation WhatsUp Gold

WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

Published · Updated

Follow this CVE+ Monitor WhatsUp Gold

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.8epss 93%
from disclosure to weapon1 day
Published on NVDAug 29
1st PoC+1d
metasploitAug 29
CISA KEV+18d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 17/2024Vulnerabilidade crítica no sistema de gerenciamento de rede WhatsUp Goldread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2024-10-07

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An unauthenticated attacker can exploit a SQL Injection flaw in WhatsUp Gold to steal encrypted user passwords without needing to log in first. This bypasses authentication entirely and compromises account security.

Technical detail

A SQL Injection vulnerability (CWE-89) in WhatsUp Gold versions prior to 2024.0.0 allows unauthenticated remote attackers to inject malicious SQL queries to extract encrypted password hashes. The vulnerability requires no prior authentication, enabling direct database access and credential compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Progress Software Corporation · WhatsUp Gold
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Progress Software Corporation WhatsUp Gold

In the same product, most dangerous first.

CVE-2024-4885CRITICALWhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution VulnerabilityEPSS 99.3%KEVCVE-2024-5010HIGHWhatsUp Gold TestController multiple information disclosure vulnerabilitiesEPSS 70.0%CVE-2024-4883CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 64.5%CVE-2024-46909CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 48.9%CVE-2024-5011HIGHWhatsUp Gold TestController Chart denial of service vulnerabilityEPSS 47.1%CVE-2024-12105MEDIUMWhatsUp Gold - SnmpExtendedActiveMonitor path traversalEPSS 41.7%