CVE-2015-6004

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-6004
Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1) the UniqueID (aka sUniqueID) parameter to WrFreeFormText.asp in the Reports component or (2) the Find Device parameter.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://twitter.com/ipswitch/statuses/677558623229317121 Vendor Advisory
http://www.securityfocus.com/bid/79506
http://www.securitytracker.com/id/1034833
https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems Exploit
https://www.kb.cert.org/vuls/id/176160 Third Party Advisory US Government Resource
http://twitter.com/ipswitch/statuses/677558623229317121 Vendor Advisory
http://www.securityfocus.com/bid/79506
http://www.securitytracker.com/id/1034833
https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems Exploit
https://www.kb.cert.org/vuls/id/176160 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*
History

21 Nov 2024, 02:34

Type Values Removed Values Added
References () http://twitter.com/ipswitch/statuses/677558623229317121 - Vendor Advisory () http://twitter.com/ipswitch/statuses/677558623229317121 - Vendor Advisory
References () http://www.securityfocus.com/bid/79506 - () http://www.securityfocus.com/bid/79506 -
References () http://www.securitytracker.com/id/1034833 - () http://www.securitytracker.com/id/1034833 -
References () https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems - Exploit () https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems - Exploit
References () https://www.kb.cert.org/vuls/id/176160 - Third Party Advisory, US Government Resource () https://www.kb.cert.org/vuls/id/176160 - Third Party Advisory, US Government Resource

27 Aug 2024, 17:48

Type Values Removed Values Added
CPE cpe:2.3:a:ipswitch:whatsup_gold:*:*:*:*:*:*:*:* cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*
First Time Progress
Progress whatsup Gold
Information

Published : 2015-12-27 03:59

Updated : 2025-04-12 10:46

NVD link : CVE-2015-6004

Mitre link : CVE-2015-6004

CVE.ORG link : CVE-2015-6004

JSON object : View

Products Affected

progress

  • whatsup_gold
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')