Skip to main content

Exploited Vulnerabilities in Progress Software WhatsUp Gold

Critical vulnerabilities could allow an attacker to retrieve a user's encrypted password

Threat ID:
CC-4550
Threat Severity:
Medium
Published:
13 September 2024 12:38 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Critical vulnerabilities could allow an attacker to retrieve a user's encrypted password

Affected platforms

The following platforms are known to be affected:

Versions: All prior to 24.0.0

Progress Software WhatsUp Gold

Threat details

Exploitation of CVE-2024-6670 & CVE-2024-6671

Proof-of-concept code is publicly available and exploitation attempts have been reported in the wild.

Introduction

Progress Software has released an advisory that addresses three critical vulnerabilities in the WhatsUp Gold System. WhatsUp Gold is a network availability and performance monitoring package.

  • CVE-2024-6670 has a CVSSv3 score of 9.8 and could allow an unauthenticated attacker to retrieve a user's encrypted password via SQL injection, if the application is configured with only a single user. 
  • CVE-2024-6671 has a CVSSv3 score of 9.8 and could allow an unauthenticated attacker to retrieve a user's encrypted password via SQL injection, if the application is configured with only a single user. 
  • CVE-2024-6672 has a CVSSv3 score of 8.8 and could allow a low-privileged attacker to achieve privilege escalation by modifying a privileged users password via SQL injection.

Remediation advice

Affected organisations are encouraged to review Progress Software's WhatsUp Gold Security Bulletin – August 2024 and apply the relevant updates.

Last edited: 13 September 2024 12:40 pm