VulnerabilityModified
CVE-2023-6368
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism.
MEDIUM 5.3EPSS 0.55%
Does this matter?
Lower severity and a low EPSS score (0.55%). Track it; it rarely justifies an emergency change on its own.
Description
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.55% probability · 45th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- progress/whatsup gold
- Source
- security@progress.com
References
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023Vendor Advisory
- https://www.progress.com/network-monitoringProduct
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023Vendor Advisory
- https://www.progress.com/network-monitoringProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.