CVE-2023-6595

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

I

n WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.

References

Link	Resource
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023	Vendor Advisory
https://www.progress.com/network-monitoring	Product
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023	Vendor Advisory
https://www.progress.com/network-monitoring	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:44

Type	Values Removed	Values Added
References	~~() https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 - Vendor Advisory~~	() https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 - Vendor Advisory
References	~~() https://www.progress.com/network-monitoring - Product~~	() https://www.progress.com/network-monitoring - Product
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 7.5

16 Oct 2024, 15:15

Type	Values Removed	Values Added
CWE	~~CWE-862~~
Summary	(en) In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.	(en) In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.

Information

Published : 2023-12-14 16:15

Updated : 2024-11-21 08:44

NVD link : CVE-2023-6595

Mitre link : CVE-2023-6595

CVE.ORG link : CVE-2023-6595

JSON object : View

Products Affected

whatsup_gold

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2023-6595", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-12-14T16:15:54.453", "references": [{"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold."}, {"lang": "es", "value": "En las versiones de WhatsUp Gold lanzadas antes de 2023.1, se descubri\u00f3 que a un endpoint de API le faltaba un mecanismo de autenticaci\u00f3n. Es posible que un atacante no autenticado enumere informaci\u00f3n de credenciales auxiliares almacenada en WhatsUp Gold."}], "lastModified": "2024-11-21T08:44:10.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D27D3E3-A9E8-493A-8D4A-51ED537ABC7D", "versionEndExcluding": "23.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}