Exploit / PoCcriticalExploited in the wild

Progress WhatsUp Gold Exploited Just Hours After PoC Release for Critical Flaw

The Hacker Newsby @TheHackersNewsSep 15, 2024 · 00:00 UTC (Sep 15, 2024)2 min read1

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2024-6670 CVE-2024-6671 CVE-2024-4885 CVE-2023-22527

Tags: cve-2024-6670 cve-2024-6671 cve-2024-4885 cve-2023-22527 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-22527	Unauthenticated OGNL Template Injection RCE in Atlassian Confluence Data Center/Server	9.8	100%	KEVRansomwarePoC ×2	Jan 16, 2024 KEV Jan 24, 2024
CVE-2024-4885	Unauthenticated Path Traversal RCE in Progress WhatsUp Gold	9.8	99%	KEV	Jun 25, 2024 KEV Mar 3, 2025
CVE-2024-6670 +1 related CVE CVE-2024-6671	Unauthenticated SQL Injection in Progress WhatsUp Gold (CVE-2024-6670)	9.8	93%	KEVRansomware	Aug 29, 2024 KEV Sep 16, 2024

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Sep 13, 2024 Software Security / Threat Intelligence Malicious actors are likely leveraging publicly available proof-of-concept (PoC) exploits for recently disclosed security flaws in Progress Software WhatsUp Gold to conduct opportunistic attacks. The activity is said to have commenced on August 30, 2024, a mere five hours after a PoC was released for CVE-2024-6670 (CVSS score: 9.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.