CVE-2022-29845 — MEDIUM (6.5)

Vulnerability Description

In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Progress	Whatsup Gold	21.1.0

Related Weaknesses (CWE)

CWE-829

References

https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-MayVendor Advisory
https://www.progress.com/network-monitoringProduct
https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-MayVendor Advisory
https://www.progress.com/network-monitoringProduct

FAQ

What is CVE-2022-29845?

CVE-2022-29845 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.

How severe is CVE-2022-29845?

CVE-2022-29845 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-29845?

Check the references section above for vendor advisories and patch information. Affected products include: Progress Whatsup Gold.