VulnerabilityModified
CVE-2023-6595
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism.
MEDIUM 5.3EPSS 0.80%
Does this matter?
Lower severity and a low EPSS score (0.80%). Track it; it rarely justifies an emergency change on its own.
Description
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.80% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- progress/whatsup gold
- Source
- security@progress.com
References
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023Vendor Advisory
- https://www.progress.com/network-monitoringProduct
- https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023Vendor Advisory
- https://www.progress.com/network-monitoringProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.