PT-2018-1307 · Ipswitch · Ipswitch Whatsup Gold

Vyacheslav Moskvin · Published 2018-03-22 · Updated 2024-08-27 · CVE-2018-8938

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ipswitch WhatsUp Gold versions prior to 18.0

Description A Code Injection issue was discovered in DlgSelectMibFile.asp, related to errors in code generation management. This issue allows malicious actors to inject a specially crafted SNMP MIB file, potentially enabling them to execute arbitrary commands and code on the WhatsUp Gold server.

Recommendations For versions prior to 18.0, update to version 18.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the DlgSelectMibFile.asp component to minimize the risk of exploitation. Avoid using specially crafted SNMP MIB files until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2018-00805

CVE-2018-8938

Affected Products

Ipswitch Whatsup Gold

References · 6

• https://docs.ipswitch.com/NM/WhatsUpGold2018/01_ReleaseNotes/index.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8938 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00805 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8938 · Security Note
• https://community.ipswitch.com/s/article/Externally-Reported-Security-Issues · Note
• https://t.me/cvenotify/92364 · Telegram Post