CVE-2023-31452

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-31452
A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could force PRTG to execute different actions, such as creating new users. The severity of this vulnerability is high and received a score of 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 Vendor Advisory
https://www.paessler.com/prtg/history/prtg-23#23.3.86.1520
https://www.paessler.com/prtg/history/stable Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*
History

22 Aug 2023, 19:16

Type Values Removed Values Added
References
  • (MISC) https://www.paessler.com/prtg/history/prtg-23#23.3.86.1520 -

16 Aug 2023, 12:15

Type Values Removed Values Added
Summary An issue was discovered in Paessler PRTG Network Monitor 23.2.83.1760 x64. The NetApp Volume Sensor transmits cleartext credentials over the network when the HTTP protocol is selected. This can be triggered remotely via a CSRF by simply sending a controls/addsensor3.htm link to a logged-in victim. A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could force PRTG to execute different actions, such as creating new users. The severity of this vulnerability is high and received a score of 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

14 Aug 2023, 17:08

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.5 		v2 : unknown
v3 : 8.8

11 Aug 2023, 18:17

Type Values Removed Values Added
References (MISC) https://www.paessler.com/prtg/history/stable - (MISC) https://www.paessler.com/prtg/history/stable - Release Notes
References (MISC) https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 - (MISC) https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 - Vendor Advisory
CPE cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*
CWE CWE-352
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

09 Aug 2023, 12:46

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-09 12:15

Updated : 2024-02-05 00:01

NVD link : CVE-2023-31452

Mitre link : CVE-2023-31452

CVE.ORG link : CVE-2023-31452

JSON object : View

Products Affected

paessler

  • prtg_network_monitor
CWE
CWE-352

Cross-Site Request Forgery (CSRF)