CVE-2024-6670 | THREATINT

Assigner	ProgressSoftware
Reserved	2024-07-10
Published	2024-08-29
Updated	2024-09-16

Description

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

CRITICAL: 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

0x40030fd370

2023.1.0 before 2024.0.0

affected

Credits

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative 0x40030fd3e0

References

https://www.progress.com/network-monitoring product

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 vendor-advisory

cve.org CVE-2024-6670

nvd.nist.gov CVE-2024-6670

Download JSON

https://cve.threatint.com/CVE/CVE-2024-6670

Subscribe to our newsletter to learn more about our work.