CSRF in Paessler Prtg Network Monitor
CVE-2023-31452
A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could force PRTG to execute different actions, such as creating new users. The severity of this vulnerability is high and received a score of 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.005 (40.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Paessler Prtg_network_monitor
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Release Notes)
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org
Frequently asked questions
- What is CVE-2023-31452?
- CVE-2023-31452 is a high-severity vulnerability in Paessler Prtg Network Monitor, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2023-08-09.
- How severe is CVE-2023-31452?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2023-31452 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.