CVE-2019-11073 Command injection in n/a
Remote authenticated administrators can execute arbitrary code via insufficient sanitization in HTTP Transaction Sensor settings.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11073?
CVE-2019-11073 is a high-severity command injection vulnerability in n/a, published on 16 Mar 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insufficient sanitization when passing arguments to the HttpTransactionSensor.exe binary. In order to exploit the vulnerability, remote authenticated administrators need to create a new HTTP Transaction Sensor and set specific settings when the sensor is executed.
Weakness: CWE-74
Which versions are affected by CVE-2019-11073?
It affects 1 product.
Products include Paessler Prtg Network Monitor.
How do I fix CVE-2019-11073?
No fix has been published for CVE-2019-11073 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-11073 being exploited?
There is no known exploitation of CVE-2019-11073 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion
- CVE-2018-9276 Paessler PRTG Network Monitor OS Command Injection
- CVE-2020-10374 Command injection in n/a
- CVE-2023-51630 Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability
- CVE-2023-31452 Cross-site request forgery in n/a
Sources
Also known as GHSA-2rpv-42c9-4hgr.