Lucene search

[email protected]CVE-2023-32781

HistoryAug 09, 2023 - 12:15 p.m.

CVE-2023-32781

2023-08-0912:15:10

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-32781

prtg

command injection

vulnerability

hl7 sensor

cvss

nvd

security

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

0.041 Low

EPSS

Percentile

92.1%

JSON

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CPENameOperatorVersion
paessler:prtg_network_monitorpaessler prtg network monitorlt23.3.86.1520
paessler:prtg_network_monitorpaessler prtg network monitoreq20.1.57
paessler:prtg_network_monitorpaessler prtg network monitoreq16.1.22.2657
paessler:prtg_network_monitorpaessler prtg network monitoreq15.2.16
paessler:prtg_network_monitorpaessler prtg network monitoreq18.4.45
paessler:prtg_network_monitorpaessler prtg network monitoreq19.2.49.2001
paessler:prtg_network_monitorpaessler prtg network monitoreq7.1.3.3378
paessler:prtg_network_monitorpaessler prtg network monitoreq18.3.42
paessler:prtg_network_monitorpaessler prtg network monitoreq16.4.28.7403
paessler:prtg_network_monitorpaessler prtg network monitoreq18.3.43.2323

CPE	Name	Operator	Version
paessler:prtg_network_monitor	paessler prtg network monitor	lt	23.3.86.1520
paessler:prtg_network_monitor	paessler prtg network monitor	eq	20.1.57
paessler:prtg_network_monitor	paessler prtg network monitor	eq	16.1.22.2657
paessler:prtg_network_monitor	paessler prtg network monitor	eq	15.2.16
paessler:prtg_network_monitor	paessler prtg network monitor	eq	18.4.45
paessler:prtg_network_monitor	paessler prtg network monitor	eq	19.2.49.2001
paessler:prtg_network_monitor	paessler prtg network monitor	eq	7.1.3.3378
paessler:prtg_network_monitor	paessler prtg network monitor	eq	18.3.42
paessler:prtg_network_monitor	paessler prtg network monitor	eq	16.4.28.7403
paessler:prtg_network_monitor	paessler prtg network monitor	eq	18.3.43.2323

Rows per page:

1-10 of 2341

References

packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html

kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520

www.paessler.com/prtg/history/stable

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

0.041 Low

EPSS

Percentile

92.1%

JSON

Related for CVE-2023-32781

prion1 packetstorm1 metasploit1 zdt1 rapid7blog1