community.progress.comVendor advisory
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 CVE-2024-6671
CRITICALNuclei
WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability
Record summary
CVE-2024-6671 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.
Description
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Sep 12, 2024 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 24, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
WhatsUp GoldBrowse Progress / WhatsUp GoldDefault status: affected | VulnCheck, CVE List | 2023.1.0 to < 2024.0.0 | affected |
Default status: affected | CVE List | 2023.1.0 to < 2024.0.0 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALWhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication BypassCVSS 9.8
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
Impact
Unauthenticated attackers can exploit SQL injection to retrieve encrypted user passwords, modify admin credentials, and achieve authentication bypass for full system access.
Remediation
Update WhatsUp Gold to version 2024.0.0 or later to address the SQL injection vulnerability.
WeaknessesCWE-89
Authorsdaffainfo, jjcho
Template tagscvecve2024whatsup-goldauth-bypasssqliintrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*
Shodan: title:"WhatsUp Gold" http.favicon.hash:-2107233094
https://www.zerodayinitiative.com/advisories/ZDI-24-1186/ https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 https://www.progress.com/network-monitoring
Source: ProjectDiscovery
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-6671 progress.comproduct
https://www.progress.com/network-monitoring