CVE-2024-12106 - Vulnerability Details - OpenCVE

In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0221.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Progress	Whatsup Gold

Configuration 1 [-]

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-50600	In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.progress.com/network-monitoring

History

Mon, 06 Jan 2025 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Progress Progress whatsup Gold
CPEs		cpe:2.3:a:progress:whatsup_gold::::::::
Vendors & Products		Progress Progress whatsup Gold

Tue, 31 Dec 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 31 Dec 2024 10:45:00 +0000

Type	Values Removed	Values Added
Description		In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.
Title		WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication
Weaknesses		CWE-306
References		https://www.progress.com/network-monitoring
Metrics		cvssV3_1 `{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published: 2024-12-31T10:32:02.035Z

Updated: 2025-01-04T04:55:30.898Z

Reserved: 2024-12-03T16:20:30.450Z

Link: CVE-2024-12106

Vulnrichment

Updated: 2024-12-31T15:33:49.048Z

NVD

Status : Analyzed

Published: 2024-12-31T11:15:06.637

Modified: 2025-01-06T16:54:14.560

Link: CVE-2024-12106

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-12106", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2024-12-03T16:20:30.450Z", "datePublished": "2024-12-31T10:32:02.035Z", "dateUpdated": "2025-01-04T04:55:30.898Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["APIEndpoint"], "platforms": ["Windows"], "product": "WhatsUp Gold", "vendor": "Progress Software Corporation", "versions": [{"lessThan": "2024.0.2", "status": "affected", "version": "2023.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Batuhan Er (@int20z) of Exploit7.tr"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure<span style=\"background-color: rgb(247, 247, 247);\"> LDAP settings.</span>"}], "value": "In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure\u00a0LDAP settings."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-12-31T10:32:02.035Z"}, "references": [{"url": "https://www.progress.com/network-monitoring"}], "source": {"discovery": "UNKNOWN"}, "title": "WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-03T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-12106"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-04T04:55:30.898Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-12106", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-31T15:33:44.293769Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-31T15:33:49.048Z"}}], "cna": {"title": "WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Batuhan Er (@int20z) of Exploit7.tr"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software Corporation", "modules": ["APIEndpoint"], "product": "WhatsUp Gold", "versions": [{"status": "affected", "version": "2023.1.0", "lessThan": "2024.0.2", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "affected"}], "references": [{"url": "https://www.progress.com/network-monitoring"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure\u00a0LDAP settings.", "supportingMedia": [{"type": "text/html", "value": "In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure<span style=\"background-color: rgb(247, 247, 247);\"> LDAP settings.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-12-31T10:32:02.035Z"}}}, "cveMetadata": {"cveId": "CVE-2024-12106", "state": "PUBLISHED", "dateUpdated": "2025-01-04T04:55:30.898Z", "dateReserved": "2024-12-03T16:20:30.450Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2024-12-31T10:32:02.035Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.1"}