PT-2018-1930 · Paessler · Prtg Network Monitor

Anton Vaychikauskas · Published 2018-05-07 · Updated 2019-10-03 · CVE-2018-19411

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PRTG Network Monitor versions prior to 18.2.40.1683

Description The issue is related to insecure privilege management, allowing an authenticated user with read-only privileges to create another user with read-write privileges, including administrators. This can be achieved by sending a specially crafted HTTP request to the /api/addusers endpoint, which does not properly check user rights.

Recommendations For versions prior to 18.2.40.1683, update to version 18.2.40.1683 or later to resolve the issue. As a temporary workaround, consider restricting access to the /api/addusers endpoint to prevent exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2018-01537

CVE-2018-19411

Affected Products

Prtg Network Monitor

References · 6

• https://osv.dev/vulnerability/CVE-2018-19411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19411 · Security Note
• https://bdu.fstec.ru/vul/2018-01537 · Security Note
• https://ptsecurity.com/ww-en/analytics/threatscape/pt-2018-25 · Note
• https://cxsecurity.com/cveshow/CVE-2018-19411 · Note
• https://ptsecurity.com/ru-ru/research/threatscape/pt-2018-25 · Note