title: WhatsUp Gold Unauthenticated Access to an API Endpoint
description:
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.
problem types: CWE-862 Missing Authorization
affected:
{
defaultStatus: affected
modules: API Endpoint
product: WhatsUp Gold
vendor: Progress Software Corporation
versions:
lessThan: 2023.1, status: affected, version: 2023.0, versionType: semver
lessThanOrEqual: 2022.1, status: affected, version: 2022.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL