CVE-2023-31448

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

A

path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7 sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References

Link	Resource
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520	Vendor Advisory
https://www.paessler.com/prtg/history/stable	Release Notes
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520	Vendor Advisory
https://www.paessler.com/prtg/history/stable	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:01

Type	Values Removed	Values Added
References	~~() https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 - Vendor Advisory~~	() https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 - Vendor Advisory
References	~~() https://www.paessler.com/prtg/history/stable - Release Notes~~	() https://www.paessler.com/prtg/history/stable - Release Notes

Information

Published : 2023-08-09 12:15

Updated : 2024-11-21 08:01

NVD link : CVE-2023-31448

Mitre link : CVE-2023-31448

CVE.ORG link : CVE-2023-31448

JSON object : View

Products Affected

prtg_network_monitor

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2023-31448", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.2}]}, "published": "2023-08-09T12:15:09.647", "references": [{"url": "https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.paessler.com/prtg/history/stable", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.paessler.com/prtg/history/stable", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7 sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad de path traversal en el sensor HL7 en PRTG 23.2.84.1566 y versiones anteriores donde un usuario autenticado con permisos de escritura pod\u00eda enga\u00f1ar al sensor HL7 para que se comportara de forma diferente para archivos existentes y archivos no existentes. Esto hac\u00eda posible el path traversal, permitiendo al sensor ejecutar archivos fuera de la carpeta designada de sensores personalizados. La gravedad de esta vulnerabilidad es media y ha recibido una puntuaci\u00f3n de 4,7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"}], "lastModified": "2024-11-21T08:01:53.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ED29001-6A06-457D-A606-E85C7600B6AD", "versionEndExcluding": "23.3.86.1520"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}