217 lines
8.5 KiB
JSON
217 lines
8.5 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-5013",
|
||
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "ProgressSoftware",
|
||
"dateReserved": "2024-05-16T15:59:53.459Z",
|
||
"datePublished": "2024-06-25T20:11:58.100Z",
|
||
"dateUpdated": "2024-08-01T20:55:10.406Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "affected",
|
||
"modules": [
|
||
"Installation"
|
||
],
|
||
"platforms": [
|
||
"Windows"
|
||
],
|
||
"product": "WhatsUp Gold",
|
||
"vendor": "Progress Software Corporation",
|
||
"versions": [
|
||
{
|
||
"lessThan": "2023.1.3",
|
||
"status": "affected",
|
||
"version": "2023.1.0",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "In WhatsUp Gold versions released before 2023.1.3,<span style=\"background-color: rgba(161, 189, 217, 0.08);\"> an unauthenticated Denial of Service \n\nvulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible. <code><br></code></span><span style=\"background-color: rgba(161, 189, 217, 0.08);\"><span style=\"background-color: rgba(9, 30, 66, 0.06);\"><br><br><br><br></span>\n\n</span>"
|
||
}
|
||
],
|
||
"value": "In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service \n\nvulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible."
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-113",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-113 API Manipulation"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"capecId": "CAPEC-115",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-115 Authentication Bypass"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 7.5,
|
||
"baseSeverity": "HIGH",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "NONE",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-400",
|
||
"description": "CWE-400 Uncontrolled Resource Consumption",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
|
||
"shortName": "ProgressSoftware",
|
||
"dateUpdated": "2024-06-25T20:11:58.100Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"product"
|
||
],
|
||
"url": "https://www.progress.com/network-monitoring"
|
||
},
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"title": "WhatsUp Gold InstallController Denial-of-Service Vulnerability",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.1.0-dev"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"affected": [
|
||
{
|
||
"vendor": "progress",
|
||
"product": "whatsup_gold",
|
||
"cpes": [
|
||
"cpe:2.3:a:progress:whatsup_gold:2023.1.0:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "affected",
|
||
"versions": [
|
||
{
|
||
"version": "2023.1.0",
|
||
"status": "affected",
|
||
"lessThan": "2023.1.3",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-06-26T14:03:25.828079Z",
|
||
"id": "CVE-2024-5013",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-26T23:38:21.726Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-01T20:55:10.406Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"product",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.progress.com/network-monitoring"
|
||
},
|
||
{
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |