CVE-2024-5012: WhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure Vulnerability
In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unauthenticated attackers to disclose Windows Credentials stored in the product Credential Library.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WhatsUp Goldto a version that resolves this vulnerability.Fixed in 2023.1.3 - Compensating control
Assume Windows Credentials stored in the WhatsUp Gold Credential Library may be disclosed to unauthenticated attackers; restrict network access to WhatsUp Gold to trusted sources until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5012?
CVE-2024-5012 has been classified with a high severity rating due to its potential impact on system security.
How do I fix CVE-2024-5012?
To fix CVE-2024-5012, upgrade to WhatsUp Gold version 2023.1.3 or later, which addresses the missing authentication vulnerability.
What type of vulnerability is CVE-2024-5012?
CVE-2024-5012 is a missing authentication vulnerability that allows unauthorized access to confidential Windows Credentials.
What are the risks associated with CVE-2024-5012?
The risks associated with CVE-2024-5012 include potential unauthorized disclosure of sensitive information stored in the Credential Library.
Which versions of WhatsUp Gold are affected by CVE-2024-5012?
WhatsUp Gold versions prior to 2023.1.3 are affected by CVE-2024-5012.