// For flags

CVE-2018-8939

 

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 (18.0). Malicious actors can submit specially crafted requests via the NmAPI executable to (1) gain unauthorized access to the WhatsUp Gold system, (2) obtain information about the WhatsUp Gold system, or (3) execute remote commands.

Se ha descubierto una vulnerabilidad SSRF en NmAPI.exe en Ipswitch WhatsUp Gold en versiones anteriores al 2018 (18.0). Los actores maliciosos pueden enviar peticiones especialmente manipuladas mediante el ejecutable NmAPI para (1) obtener acceso no autorizado al sistema de WhatsUp Gold, (2) obtener información sobre el sistema de WhatsUp Gold o (3) ejecutar comandos remotos.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-03-22 CVE Reserved
  • 2018-05-01 CVE Published
  • 2024-08-05 CVE Updated
  • 2024-08-28 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ipswitch
Search vendor "Ipswitch"
 Whatsup Gold
Search vendor "Ipswitch" for product "Whatsup Gold"
 < 18.0
Search vendor "Ipswitch" for product "Whatsup Gold" and version " < 18.0"
-
Affected