CVE-2024-6670

🗓️ 29 Aug 2024 22:04:41Reported by ProgressSoftwareType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 238 Views🌐 WEB

WhatsUp Gold SQL Injection Vulnerabilit

Reporter	Title	Published	Views	Family All 24
ATTACKERKB	CVE-2024-6670	29 Aug 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the WhatsUp Gold network infrastructure monitoring system lies in the lack of protective measures for the SQL query structure, allowing attackers to gain unauthorized access to user data.	16 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-6670	24 Aug 202409:50	–	circl
CISA KEV Catalog	Progress WhatsUp Gold SQL Injection Vulnerability	16 Sep 202400:00	–	cisa_kev
CISA	CISA Adds Two Known Exploited Vulnerabilities to Catalog	16 Sep 202412:00	–	cisa
CNNVD	WhatsUp Gold 安全漏洞	29 Aug 202400:00	–	cnnvd
Cvelist	CVE-2024-6670 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability	29 Aug 202422:04	–	cvelist
GithubExploit	Exploit for SQL Injection in Progress Whatsup_Gold	30 Aug 202417:13	–	githubexploit
Metasploit	WhatsUp Gold SQL Injection (CVE-2024-6670)	27 Sep 202418:53	–	metasploit
NCSC	Vulnerabilities fixed in Progress WhatsUp Gold	2 Sep 202411:51	–	ncsc

NVD

Node

progress whatsup_goldRange<24.0

[
  {
    "defaultStatus": "affected",
    "modules": [
      "API Endpoint"
    ],
    "platforms": [
      "Windows"
    ],
    "product": "WhatsUp Gold",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "2024.0.0",
        "status": "affected",
        "version": "2023.1.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
progress	www.progress.com/network-monitoring
community	www.community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
KeyStorePassword	request body	NmConsole/WugSystemAppSettings/JMXSecurity	SQL injection attempt via JSON body modifying keystore passwords (vulnerable in pre-24.0.0).	CWE-89
TrustStorePassword	request body	NmConsole/WugSystemAppSettings/JMXSecurity	SQL injection attempt via JSON body modifying keystore passwords (vulnerable in pre-24.0.0).	CWE-89
deviceId	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	SQL injection attempt via classId parameter to escalate privileges and set password.	CWE-89
classId	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	SQL injection attempt via classId parameter to escalate privileges and set password.	CWE-89
range	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	SQL injection attempt via classId parameter to escalate privileges and set password.	CWE-89
n	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	SQL injection attempt via classId parameter to escalate privileges and set password.	CWE-89
start	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	SQL injection attempt via classId parameter to escalate privileges and set password.	CWE-89
end	request body	NmConsole/Platform/PerformanceMonitorErrors/HasErrors	SQL injection attempt via classId parameter to escalate privileges and set password.	CWE-89
username	request body	NmConsole/User/LoginAjax	Final login with new credentials after password change.	CWE-259, CWE-285
password	request body	NmConsole/User/LoginAjax	Final login with new credentials after password change.	CWE-259, CWE-285

17 Jun 2026 08:18Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.94661

SSVC