CVE-2024-6670: Progress WhatsUp Gold SQL Injection Vulnerability
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
Other sources
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Progress Software WhatsUp Goldfrom your environment.Discontinue use or uninstall the product if vendor mitigations are not available.
- Configuration
Ensure the application is not configured with only a single user (create additional administrative/user accounts) to avoid the single-user configuration condition that enables this vulnerability.
Progress Software WhatsUp Gold single-user configuration = disabled / ensure multiple user accounts - Compensating control
Apply vendor-provided mitigations per Progress Software guidance. If vendor mitigations are unavailable, discontinue use of the product.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6670?
CVE-2024-6670 has a high severity rating due to its potential for unauthorized access to sensitive user information.
How do I fix CVE-2024-6670?
To fix CVE-2024-6670, update Progress WhatsUp Gold to version 2024.0.0 or later.
What type of vulnerability is CVE-2024-6670?
CVE-2024-6670 is a SQL Injection vulnerability that allows unauthorized access to encrypted passwords.
Who is affected by CVE-2024-6670?
CVE-2024-6670 affects all versions of Progress WhatsUp Gold released before 2024.0.0.
Can an attacker exploit CVE-2024-6670 remotely?
Yes, an attacker can exploit CVE-2024-6670 remotely without authentication.