CVE-2023-6595

Published Dec 14, 2023

Last updated 6 months ago

Overview

Description: In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.
Source: security@progress.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

security@progress.com: CWE-306
nvd@nist.gov: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5D27D3E3-A9E8-493A-8D4A-51ED537ABC7D",
            "versionEndExcluding": "23.1.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.