CVE-2024-6670: Progress WhatsUp Gold SQL Injection Vulnerability
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
Other sources
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of Progress WhatsUp Gold if vendor mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6670?
CVE-2024-6670 has a high severity rating due to its potential for unauthorized access to sensitive user information.
How do I fix CVE-2024-6670?
To fix CVE-2024-6670, update Progress WhatsUp Gold to version 2024.0.0 or later.
What type of vulnerability is CVE-2024-6670?
CVE-2024-6670 is a SQL Injection vulnerability that allows unauthorized access to encrypted passwords.
Who is affected by CVE-2024-6670?
CVE-2024-6670 affects all versions of Progress WhatsUp Gold released before 2024.0.0.
Can an attacker exploit CVE-2024-6670 remotely?
Yes, an attacker can exploit CVE-2024-6670 remotely without authentication.