PT-2023-23337 · Paessler · Prtg
Publicado
2023-08-09
·
Atualizado
2023-08-22
·
CVE-2023-31452
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PRTG versions 23.2.84.1566 and earlier
Description
A cross-site request forgery (CSRF) token bypass was identified that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could force PRTG to execute different actions, such as creating new users. Additionally, the NetApp Volume Sensor in PRTG transmits cleartext credentials over the network when the HTTP protocol is selected, which can be triggered remotely via a CSRF by sending a "controls/addsensor3.htm" link to a logged-in victim.
Recommendations
For PRTG versions 23.2.84.1566 and earlier, consider disabling the NetApp Volume Sensor until a patch is available to prevent cleartext credentials from being transmitted over the network. As a temporary workaround, restrict access to the "controls/addsensor3.htm" link to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Prtg