CVE-2023-6367

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles.

If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Progress Software Corporation	WhatsUp Gold	>= 2023.0, < 2023.1; >= 2022.0, <= 2022.1

References

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023Vendor Advisory
https://www.progress.com/network-monitoringProduct
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023Vendor Advisory
https://www.progress.com/network-monitoringProduct

Timeline

Published: Dec 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-63685.3In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an CVE-2023-63695.4The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a mi CVE-2023-63715.4An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versio CVE-2023-63738.8The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to CVE-2023-63747.5Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers a CVE-2023-63757.5Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker. Ba CVE-2023-63767.5Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, CVE-2023-63777.8A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-boun CVE-2023-63787.5A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service CVE-2023-63796.1Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerab CVE-2023-63806.1Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could CVE-2023-63815.5Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vu