PT-2018-1930 · Paessler · Prtg Network Monitor
Anton Vaychikauskas
·
Publicado
2018-05-07
·
Atualizado
2019-10-03
·
CVE-2018-19411
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PRTG Network Monitor versions prior to 18.2.40.1683
Description
The issue is related to insecure privilege management, allowing an authenticated user with read-only privileges to create another user with read-write privileges, including administrators. This can be achieved by sending a specially crafted HTTP request to the /api/addusers endpoint, which does not properly check user rights.
Recommendations
For versions prior to 18.2.40.1683, update to version 18.2.40.1683 or later to resolve the issue.
As a temporary workaround, consider restricting access to the /api/addusers endpoint to prevent exploitation.
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Prtg Network Monitor