WhatsUp Gold getReport Missing Authentication Authentication Bypass Vulnerability

The impact of CVE-2024-7763 is severe. Successful exploitation allows an attacker to bypass authentication mechanisms and gain access to encrypted user credentials. This could lead to unauthorized access to sensitive network data, including configuration details, performance metrics, and potentially even administrative controls. Compromised credentials could be used for lateral movement within the network, allowing the attacker to escalate privileges and further compromise systems. The blast radius extends to any systems monitored by WhatsUp Gold, as the attacker could leverage stolen credentials to gain insights into the entire network infrastructure.

Organizations heavily reliant on WhatsUp Gold for network monitoring are particularly at risk. This includes managed service providers (MSPs) who manage monitoring for multiple clients, as a single compromised WhatsUp Gold instance could impact numerous networks. Environments with weak password policies or a lack of MFA are also at heightened risk.

• nagios / server:

journalctl -u whats_gold -g 'authentication bypass'

• nagios / server:

ps aux | grep -i 'authentication bypass'

• nagios / server: Check WhatsUp Gold logs for unusual authentication patterns or failed login attempts. • nagios / server: Review user account permissions and ensure least privilege is enforced.

1. 2024-10-24Disclosure

   disclosure

1. Reservado2024-08-13
2. Publicada2024-10-24
3. Modificada2024-10-29
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-7763 is to upgrade to WhatsUp Gold version 2024.0.0 or later, which contains the fix. If immediate upgrade is not possible due to compatibility issues or testing requirements, consider implementing stricter access controls and multi-factor authentication (MFA) to limit the impact of a potential compromise. Monitor WhatsUp Gold logs for suspicious authentication attempts. After upgrading, confirm the fix by attempting to reproduce the authentication bypass scenario and verifying that it is no longer possible.