CVE-2024-6670

🗓️ 29 Aug 2024 22:04:41Reported by ProgressSoftwareType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 231 Views🌐 WEB

WhatsUp Gold SQL Injection Vulnerabilit

Reporter	Title	Published	Views	Family All 24
ATTACKERKB	CVE-2024-6670	29 Aug 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the WhatsUp Gold network infrastructure monitoring system lies in the lack of protective measures for the SQL query structure, allowing attackers to gain unauthorized access to user data.	16 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-6670	24 Aug 202409:50	–	circl
CISA KEV Catalog	Progress WhatsUp Gold SQL Injection Vulnerability	16 Sep 202400:00	–	cisa_kev
CISA	CISA Adds Two Known Exploited Vulnerabilities to Catalog	16 Sep 202412:00	–	cisa
CNNVD	WhatsUp Gold 安全漏洞	29 Aug 202400:00	–	cnnvd
Cvelist	CVE-2024-6670 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability	29 Aug 202422:04	–	cvelist
GithubExploit	Exploit for SQL Injection in Progress Whatsup_Gold	30 Aug 202417:13	–	githubexploit
Metasploit	WhatsUp Gold SQL Injection (CVE-2024-6670)	27 Sep 202418:53	–	metasploit
NCSC	Vulnerabilities fixed in Progress WhatsUp Gold	2 Sep 202411:51	–	ncsc

NVD

Node

progress whatsup_goldRange<24.0

[
  {
    "defaultStatus": "affected",
    "modules": [
      "API Endpoint"
    ],
    "platforms": [
      "Windows"
    ],
    "product": "WhatsUp Gold",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "2024.0.0",
        "status": "affected",
        "version": "2023.1.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
progress	www.progress.com/network-monitoring
community	www.community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
KeyStorePassword	request body	NmConsole/WugSystemAppSettings/JMXSecurity	POST to set Java keystore passwords via JMXSecurity endpoint enabling password update via SQLi chain	CWE-89
TrustStorePassword	request body	NmConsole/WugSystemAppSettings/JMXSecurity	POST to set Java keystore passwords via JMXSecurity endpoint enabling password update via SQLi chain	CWE-89
deviceId	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	POST containing a crafted classId to trigger SQL injection and escalate privileges	CWE-89
classId	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	POST containing a crafted classId to trigger SQL injection and escalate privileges	CWE-89
range	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	POST containing a crafted classId to trigger SQL injection and escalate privileges	CWE-89
n	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	POST containing a crafted classId to trigger SQL injection and escalate privileges	CWE-89
start	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	POST containing a crafted classId to trigger SQL injection and escalate privileges	CWE-89
end	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	POST containing a crafted classId to trigger SQL injection and escalate privileges	CWE-89
username	request body	NmConsole/User/LoginAjax	POST login with attacker-controlled credentials after password update to verify access	CWE-89
password	request body	NmConsole/User/LoginAjax	POST login with attacker-controlled credentials after password update to verify access	CWE-89

17 Jun 2026 08:18Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.94661

SSVC