PT-2022-19871 · Ipswitch · Ipswitch Whatsup Gold

Published 2022-05-11 · Updated 2024-08-27 · CVE-2022-29845

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ipswitch WhatsUp Gold versions 21.1.0 through 21.1.1 Ipswitch WhatsUp Gold version 22.0.0

Description The issue allows an authenticated user to invoke an API transaction to read the contents of a local file.

Recommendations For Ipswitch WhatsUp Gold versions 21.1.0 through 21.1.1, update to a version that fixes this issue. For Ipswitch WhatsUp Gold version 22.0.0, update to a version that fixes this issue. As a temporary workaround, consider restricting access to API transactions that allow reading local file contents until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2022-29845

Affected Products

Ipswitch Whatsup Gold

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/whatsupgold_credential_dump.rb · Exploit
• https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29845 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29845 · Vendor Advisory
• https://t.me/cibsecurity/42439 · Telegram Post
• https://t.me/cvenotify/92366 · Telegram Post
• https://progress.com/network-monitoring · Note