#VU102312 Cross-site scripting in PRTG Network Monitor - CVE-2024-12833

Vulnerability identifier: #VU102312

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-12833

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
PRTG Network Monitor
Server applications / Remote management servers, RDP, SSH

Vendor: Paessler AG

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the PRTG Network Monitor web interface. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation
Install update from vendor's website.

Vulnerable software versions

PRTG Network Monitor: 21.1.65.1767 - 21.1.66.1664, 21.2.67.1531 - 21.2.69.1308, 21.3.69.1333 - 21.3.71.1416, 21.4.72.1649 - 21.4.73.1656, 22.1.74.1869 - 22.1.75.1588, 22.2.76.1705 - 22.2.77.2204, 22.3.78.1873 - 22.3.79.2108, 22.4.80.1553 - 22.4.81.1532, 23.1.82.2074 - 23.1.82.2175, 23.2.83.1760 - 23.2.86.1520, 23.3.86.1520 - 23.3.88.1421, 23.4.88.1429 - 23.4.90.1299, 24.1.90.1306 - 24.1.92.1554, 24.2.94.1400 - 24.2.96.1375, 24.3.98.1210 - 24.3.100.1361, 24.4.102.135 - 24.4.102.1351

---

External links
https://www.zerodayinitiative.com/advisories/ZDI-24-1736/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.