CVE-2018-19410: Paessler PRTG Network Monitor Local File Inclusion Vulnerability
Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).
Other sources
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paessler PRTG Network Monitorto a version that resolves this vulnerability.Fixed in 18.2.40.1683
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for PRTG Network Monitor?
The vulnerability ID for PRTG Network Monitor is CVE-2018-19410.
What is the severity of CVE-2018-19410?
The severity of CVE-2018-19410 is critical with a score of 9.8.
How does CVE-2018-19410 impact PRTG Network Monitor?
CVE-2018-19410 allows remote unauthenticated attackers to create users with read-write privileges, including administrator access.
Is there a fix for CVE-2018-19410?
Yes, updating PRTG Network Monitor to version 18.2.40.1683 or newer will fix the vulnerability.
Where can I find more information about CVE-2018-19410?
You can find more information about CVE-2018-19410 at the following link: [https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-24/](https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-24/)