Missing authorization in PRTG Network Monitor

1) Missing Authorization

EUVDB-ID: #VU103630

Risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:]

CVE-ID: CVE-2018-19410

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization. A remote non-authenticated attacker can send a specially crafted HTTP request to application and create users with read-write privileges, including administrators.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PRTG Network Monitor: 17.1.28.1032 - 18.2.39.1661

CPE2.3

• cpe:2.3:a:paessler_ag:prtg_network_monitor:17.1.30.1719:*:*:*:*:*:*:*
• cpe:2.3:a:paessler_ag:prtg_network_monitor:17.2.32.2279:*:*:*:*:*:*:*
• cpe:2.3:a:paessler_ag:prtg_network_monitor:17.3.33.2830:*:*:*:*:*:*:*
• cpe:2.3:a:paessler_ag:prtg_network_monitor:17.4.36.3670:*:*:*:*:*:*:*
• cpe:2.3:a:paessler_ag:prtg_network_monitor:18.1.39.1648:*:*:*:*:*:*:*
• cpe:2.3:a:paessler_ag:prtg_network_monitor:18.2.39.1661:*:*:*:*:*:*:*

External links

https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-24/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?