PT-2021-18380 · Microsoft+1 · Active Directory+1

Matt Dunn · Published 2021-09-13 · Updated 2021-09-22 · CVE-2021-29643

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PRTG Network Monitor versions prior to 21.3.69.1333

Description The issue allows stored XSS via an unsanitized string imported from a User Object in a connected Active Directory instance. This occurs due to the lack of proper sanitization of the imported string.

Recommendations For versions prior to 21.3.69.1333, update to version 21.3.69.1333 or later to resolve the issue. As a temporary workaround, consider restricting the import of unsanitized strings from connected Active Directory instances to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-29643

Affected Products

Active Directory

Prtg Network Monitor

References · 5

• 🔥 https://raxis.com/blog/prtg-network-monitor-cve-2021-29643 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-29643 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29643 · Vendor Advisory
• https://paessler.com/prtg/history/stable#21.3.69.1333 · Vendor Advisory
• https://t.me/cibsecurity/28721 · Telegram Post