Progress · WhatsUp Gold
CVE-2024-6670
WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
Qué es
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
CISA: Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
Qué hacer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 7 de octubre de 2024
Más fallos explotados de Progress
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 3 mar 2025 | Path Traversal | WhatsUp Gold | Crítica 9,8 | 99,3% |
| 7 ago 2026 | Command Injection | LoadMaster | Crítica 9,6 | 99,8% |
| 18 nov 2024 | OS Command Injection | Kemp LoadMaster | Crítica 10,0 | 95% |
| 13 jun 2024 | Authentication Bypass by Spoofing | Telerik Report Server | Crítica 9,8 | 97% |
| 5 oct 2023 | Deserialization of Untrusted Data | WS_FTP Server | Crítica 10,0 | 90% |
| 2 jun 2023 | SQL Injection | MOVEit Transfer | Crítica 9,8 | 99,9% |
| 3 nov 2021 | Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness | ASP.NET AJAX and Sitefinity | Crítica 9,8 | 75% |
| 3 nov 2021 | Deserialization of Untrusted Data | Telerik UI for ASP.NET AJAX | Crítica 9,8 | 99,7% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.