CVE-2023-32781

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520	Vendor Advisory
https://www.paessler.com/prtg/history/stable	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-08-09 12:15

Updated : 2024-01-23 17:15

NVD link : CVE-2023-32781

Mitre link : CVE-2023-32781

CVE.ORG link : CVE-2023-32781

JSON object : View

Products Affected

paessler

prtg_network_monitor

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2023-32781", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2023-08-09T12:15:10.047", "references": [{"url": "http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html", "source": "cve@mitre.org"}, {"url": "https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.paessler.com/prtg/history/stable", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad de inyecci\u00f3n de comandos en PRTG 23.2.84.1566 y versiones anteriores en el sensor HL7 donde un usuario autenticado con permisos de escritura podr\u00eda abusar de la opci\u00f3n de depuraci\u00f3n para escribir nuevos archivos que potencialmente podr\u00edan ser ejecutados por el sensor EXE/Script. La gravedad de esta vulnerabilidad es alta y ha recibido una puntuaci\u00f3n de 7,2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}], "lastModified": "2024-01-23T17:15:09.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ED29001-6A06-457D-A606-E85C7600B6AD", "versionEndExcluding": "23.3.86.1520"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}