Login Request a demo
Medium severity · published Aug 9, 2023
CVE-2023-31448
A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7…
4.7
CVSS
0.5%
EPSS
No
On KEV
Description
A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7 sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PN
Prtg Network Monitor · Paessler
before 23.3.86.1520 · source: NVD
Affected product
PN
Prtg Network Monitor
Paessler
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-31448
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-31448
Vendor Advisory
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
Release Notes
https://www.paessler.com/prtg/history/stable
More from Prtg Network Monitor
9.8
CVE-2018-19410
Paessler PRTG Network Monitor Local File Inclusion Vulnerability
7.2
CVE-2018-9276
Paessler PRTG Network Monitor OS Command Injection Vulnerability
9.8
CVE-2020-10374
A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or the what parameter of…
8.8
CVE-2023-31452
A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a…
8.8
CVE-2018-19411
PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account (including administrator) via an…