CVE-2023-6595
Assigner: ProgressSoftware
Published: 2023-12-14T16:06:11.767Z
State: PUBLISHED
affected: defaultStatus: affected
modules: API Endpoint
product: WhatsUp Gold
vendor: Progress Software Corporation
versions: lessThan: 2023.1
status: affected
version: 2023.0
versionType: semver
lessThanOrEqual: 2022.1
status: affected
version: 2022.0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: 

In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.<br><br>
value: 
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.


impacts: capecId: CAPEC-113
descriptions: value: CAPEC-113 API Manipulation
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
source: discovery: UNKNOWN
title: WhatsUp Gold Unauthenticated Access to an API Endpoint
x_generator: engine: Vulnogram 0.1.0-dev