CVE-2024-6671: critical vulnerability in Progress Software Corporation WhatsUp Gold
WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
70Vexday Risk Score
Patch now. It exploitation observed by VulnCheck, has an official Brazilian government alert and has a working public exploit.
ssvc Actcvss 9.8epss 19%
from disclosure to weapon
Published on NVDAug 29
VulnCheck+14d
Official alert in Brazil
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 17/2024Vulnerabilidade crítica no sistema de gerenciamento de rede WhatsUp Goldread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Progress Software Corporation · WhatsUp GoldRelated CVEs — Progress Software Corporation WhatsUp Gold
In the same product, most dangerous first.
CVE-2024-4885CRITICALWhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution VulnerabilityEPSS 99.3%KEVCVE-2024-6670CRITICALWhatsUp Gold HasErrors SQL Injection Authentication Bypass VulnerabilityEPSS 92.9%KEVCVE-2024-5010HIGHWhatsUp Gold TestController multiple information disclosure vulnerabilitiesEPSS 70.0%CVE-2024-4883CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 64.5%CVE-2024-46909CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 48.9%CVE-2024-5011HIGHWhatsUp Gold TestController Chart denial of service vulnerabilityEPSS 47.1%