{"id":"CVE-2024-6671","title":"In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.","summary":"In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-89"],"vendor":"progress","product":"whatsup_gold","affected":["whatsup_gold >= 23.1.0, < 24.0"],"patched":["whatsup_gold 24.0"],"published":"2024-08-29","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:17:29.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-6671","references":[{"url":"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024","label":"security@progress.com"},{"url":"https://www.progress.com/network-monitoring","label":"security@progress.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2024-09-25T03:55:42.705186Z"},"epss":0.18988,"epssPercentile":0.97312,"exploits":{"nuclei":["CVE-2024-6671"],"checkedAt":"2026-11-05T06:38:49.869Z"},"exploitAvailable":true,"ingestedAt":"2026-11-05T06:38:03.578Z","slug":"CVE-2024-6671","body":"## Overview\n\nIn WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.\n\n## Affected\n\n- `whatsup_gold >= 23.1.0, < 24.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `whatsup_gold 24.0`","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":53.9,"likelihood":3.8,"exploitation":12,"ransomware":0},"changes":[]}