PT-2018-1306 · Ipswitch · Ipswitch Whatsup Gold

Timofey Milovanov + 1 · Published 2018-03-22 · Updated 2024-08-27 · CVE-2018-8939

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ipswitch WhatsUp Gold versions prior to 18.0

Description A Server-Side Request Forgery (SSRF) issue was discovered in the NmAPI.exe executable. This allows malicious actors to submit specially crafted requests to gain unauthorized access to the system, obtain information about the system, or execute remote commands. The issue is related to insufficient validation of incoming requests.

Recommendations For Ipswitch WhatsUp Gold versions prior to 18.0, update to version 18.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the NmAPI executable to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2018-00804

CVE-2018-8939

Affected Products

Ipswitch Whatsup Gold

References · 7

• https://docs.ipswitch.com/NM/WhatsUpGold2018/01_ReleaseNotes/index.htm · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00804 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8939 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8939 · Vendor Advisory
• https://community.ipswitch.com/s/article/Externally-Reported-Security-Issues · Note
• https://t.me/cvenotify/92365 · Telegram Post
• https://saucs.com/cve/CVE-2018-8939 · Note