CVE-2023-31452

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-31452
A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could force PRTG to execute different actions, such as creating new users. The severity of this vulnerability is high and received a score of 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 Vendor Advisory
https://www.paessler.com/prtg/history/prtg-23#23.3.86.1520
https://www.paessler.com/prtg/history/stable Release Notes
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 Vendor Advisory
https://www.paessler.com/prtg/history/prtg-23#23.3.86.1520
https://www.paessler.com/prtg/history/stable Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:01

Type Values Removed Values Added
References () https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 - Vendor Advisory () https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 - Vendor Advisory
References () https://www.paessler.com/prtg/history/prtg-23#23.3.86.1520 - () https://www.paessler.com/prtg/history/prtg-23#23.3.86.1520 -
References () https://www.paessler.com/prtg/history/stable - Release Notes () https://www.paessler.com/prtg/history/stable - Release Notes
Summary
  • (es) Se ha identificado un bypass de token de cross-site request forgery (CSRF) en PRTG 23.2.84.1566 y versiones anteriores que permite a atacantes remotos realizar acciones con los permisos de un usuario víctima, siempre que el usuario víctima tenga una sesión activa y sea inducido a lanzar la petición maliciosa. Esto podría forzar a PRTG a ejecutar diferentes acciones, como la creación de nuevos usuarios. La gravedad de esta vulnerabilidad es alta y ha recibido una puntuación de 8,8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Information

Published : 2023-08-09 12:15

Updated : 2024-11-21 08:01

NVD link : CVE-2023-31452

Mitre link : CVE-2023-31452

CVE.ORG link : CVE-2023-31452

JSON object : View

Products Affected

paessler

  • prtg_network_monitor
CWE
CWE-352

Cross-Site Request Forgery (CSRF)