PT-2023-23337 · Paessler · Prtg

Published 2023-08-09 · Updated 2023-08-22 · CVE-2023-31452

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PRTG versions 23.2.84.1566 and earlier

Description A cross-site request forgery (CSRF) token bypass was identified that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could force PRTG to execute different actions, such as creating new users. Additionally, the NetApp Volume Sensor in PRTG transmits cleartext credentials over the network when the HTTP protocol is selected, which can be triggered remotely via a CSRF by sending a "controls/addsensor3.htm" link to a logged-in victim.

Recommendations For PRTG versions 23.2.84.1566 and earlier, consider disabling the NetApp Volume Sensor until a patch is available to prevent cleartext credentials from being transmitted over the network. As a temporary workaround, restrict access to the "controls/addsensor3.htm" link to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-31452

Affected Products

Prtg

References · 9

• https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31452 · Security Note
• https://t.me/cibsecurity/68092 · Telegram Post
• https://paessler.com/prtg/history/prtg-23#23.3.86.1520 · Note
• https://t.me/cvenotify/56084 · Telegram Post
• https://paessler.com/prtg/history/stable · Note
• https://t.me/cvenotify/56426 · Telegram Post
• https://t.me/cvenotify/56584 · Telegram Post