CVE-2022-29845
Published: 11 May 2022
Summary
CVE-2022-29845 is a medium-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Progress Whatsup Gold. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-29845 is a medium-severity vulnerability in Progress Ipswitch WhatsUp Gold versions 21.1.0 through 21.1.1 and 22.0.0. It stems from insufficient access controls on an API endpoint, allowing an authenticated user to supply a transaction that reads arbitrary local files on the server. The flaw carries a CVSS 3.1 score of 6.5 and is associated with CWE-829.
An attacker who already possesses valid low-privileged credentials can exploit the issue remotely over the network with low complexity and no user interaction. Successful exploitation grants read access to sensitive file contents, resulting in high confidentiality impact while leaving integrity and availability unaffected.
Progress has published a critical product alert that directs customers to mitigation guidance and updated builds; administrators are advised to apply the recommended patches or configuration changes referenced in the advisory at community.progress.com.
The EPSS score for this CVE is currently 0.4439, matching its recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-34163
Vulnerability details
In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.
The inventory process requires identifying and recording the origin of all components, making inclusion of functionality from untrusted control spheres easier to detect during reviews.
Requiring approval and monitoring of maintenance tools prevents inclusion and execution of functionality obtained from untrusted sources.
Unowned portable devices represent untrusted control spheres; the prohibition prevents inclusion of functionality or data from such sources.
Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.
Procedures can mandate supply-chain vetting and restrictions on functionality obtained from untrusted third-party or external control spheres.
Requires use of trusted sources and provenance tracking, tangibly limiting inclusion of functionality from untrusted control spheres.