by Kastro
Paper/Archive/CVE-2024-6670

CVE-2024-6670

Progress Software Corporation WhatsUp Gold — WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

KEV · due 7 Octransomware useEPSS 93%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

Affected

ProductAffectedFixed inSource
WhatsUp Gold2023.1.0 – < 2024.0.02024.0.0CNA
whatsupgold2023.1.0 – < 2024.0.02024.0.0CISA-ADP

Scores by source

ProgressSoftware (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refprogress.com/network-monitoringadvisorycommunity.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6670kevcisa.gov/known-exploited-vulnerabilities-catalog