CVE-2023-31450 Path traversal in n/a
Authenticated users with write permissions can exploit path traversal in SQL v2 sensors to execute files outside the designated folder.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31450?
CVE-2023-31450 is a medium-severity path traversal vulnerability in n/a, published on 9 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the SQL v2 sensors into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-22
Which versions are affected by CVE-2023-31450?
It affects 1 product.
Products include Paessler Prtg Network Monitor.
How do I fix CVE-2023-31450?
No fix has been published for CVE-2023-31450 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-31450 being exploited?
There is no known exploitation of CVE-2023-31450 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion
- CVE-2018-9276 Paessler PRTG Network Monitor OS Command Injection
- CVE-2020-10374 Command injection in n/a
- CVE-2023-51630 Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability
- CVE-2023-31452 Cross-site request forgery in n/a
Sources
Also known as GHSA-fmpq-jp35-g5hj.