CVE-2023-6368

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Progress Software Corporation	WhatsUp Gold	>= 2023.0, < 2023.1; >= 2022.0, <= 2022.1

References

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023Vendor Advisory
https://www.progress.com/network-monitoringProduct
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023Vendor Advisory
https://www.progress.com/network-monitoringProduct

Timeline

Published: Dec 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-63695.4The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a mi CVE-2023-63715.4An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versio CVE-2023-63738.8The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to CVE-2023-63747.5Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers a CVE-2023-63757.5Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker. Ba CVE-2023-63767.5Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, CVE-2023-63777.8A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-boun CVE-2023-63787.5A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service CVE-2023-63796.1Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerab CVE-2023-63806.1Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could CVE-2023-63815.5Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vu CVE-2023-63825.4The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide' sh