PT-2018-1306 · Ipswitch · Ipswitch Whatsup Gold

Timofey Milovanov + 1 · Publicado 2018-03-22 · Atualizado 2024-08-27 · CVE-2018-8939

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ipswitch WhatsUp Gold versions prior to 18.0

Description A Server-Side Request Forgery (SSRF) issue was discovered in the NmAPI.exe executable. This allows malicious actors to submit specially crafted requests to gain unauthorized access to the system, obtain information about the system, or execute remote commands. The issue is related to insufficient validation of incoming requests.

Recommendations For Ipswitch WhatsUp Gold versions prior to 18.0, update to version 18.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the NmAPI executable to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2018-00804

CVE-2018-8939

Produtos afetados

Ipswitch Whatsup Gold

Referências · 7

• https://docs.ipswitch.com/NM/WhatsUpGold2018/01_ReleaseNotes/index.htm · Aviso do Fabricante
• https://community.ipswitch.com/s/article/Externally-Reported-Security-Issues · Nota
• https://t.me/cvenotify/92365 · Publicação no Telegram
• https://saucs.com/cve/CVE-2018-8939 · Nota
• https://bdu.fstec.ru/vul/2018-00804 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-8939 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-8939 · Aviso do Fabricante