CVE-2024-6670
Progress WhatsUp Gold SQL Injection Vulnerability
Published Aug 29, 2024 · updated Jun 17, 2026 · progress whatsup gold
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Aug 29, 2024 · Catalog
Detected
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
Sep 16, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Oct 7, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Oct 7, 2024
Affected
- cpe progress/whatsup goldversion unspecified
- vendor Progress WhatsUp Goldversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2024-6670
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
cisa.gov - CVE.orgVulnerability recordCVE-2024-6670
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2024-6670
30-day exploitation probability 93.0%
first.org - Metasploit ModulesPublic exploit moduleauxiliary_admin/http/whatsup_gold_sqli
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2024-6670
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
nvd.nist.gov