CVE-2024-6671: WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability
Published Aug 29, 2024
·Updated
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
Affected Software
1 affected component
Progress WhatsUp Gold>=23.1.0<24.0
Event History
Aug 29, 2024
CVE Published
via MITRE·10:06 PM
Data Sourced
via MITRE·10:06 PM
DescriptionSeverityWeakness
Sep 12, 2024
News Published
via BleepingComputer·04:27 PM
News Published
via BleepingComputer·04:38 PM
Sep 27, 2024
News Published
via BleepingComputer·12:01 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-6671?
CVE-2024-6671 is considered a high severity vulnerability due to the potential for unauthenticated attackers to access sensitive user data.
2
How do I fix CVE-2024-6671?
To fix CVE-2024-6671, upgrade your WhatsUp Gold installation to version 2024.0.0 or later.
3
Who is affected by CVE-2024-6671?
CVE-2024-6671 affects installations of WhatsUp Gold versions prior to 2024.0.0 that are configured with a single user.
4
What type of vulnerability is CVE-2024-6671?
CVE-2024-6671 is classified as a SQL Injection vulnerability.
5
Can CVE-2024-6671 be exploited remotely?
Yes, CVE-2024-6671 can be exploited remotely by an unauthenticated attacker.