PT-2023-23333 · Prtg · Prtg

Published 2023-08-09 · Updated 2023-08-16 · CVE-2023-31448

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PRTG versions 23.2.84.1566 and earlier

Description A path traversal vulnerability was identified in the HL7 sensor where an authenticated user with write permissions could trick the sensor into behaving differently for existing files and non-existing files, allowing the sensor to execute files outside the designated custom sensors folder.

Recommendations For versions 23.2.84.1566 and earlier, consider disabling the HL7 sensor until a patch is available to prevent path traversal exploitation. Restrict access to the HL7 message input parameter to minimize the risk of arbitrary file choice from the system.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-31448

Affected Products

Prtg

References · 9

• https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31448 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31448 · Security Note
• https://t.me/cvenotify/56587 · Telegram Post
• https://t.me/cibsecurity/68090 · Telegram Post
• https://t.me/cvenotify/56523 · Telegram Post
• https://t.me/cvenotify/56296 · Telegram Post
• https://t.me/cvenotify/56087 · Telegram Post
• https://paessler.com/prtg/history/stable · Note