CVE-2023-31452: CSRF
A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could force PRTG to execute different actions, such as creating new users. The severity of this vulnerability is high and received a score of 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of the CSRF token bypass in PRTG?
The vulnerability ID is CVE-2023-31452.
What is the severity of CVE-2023-31452?
The severity of CVE-2023-31452 is high, with a score of 8.8.
What is the affected software by CVE-2023-31452?
The affected software is PRTG Network Monitor versions 23.2.84.1566 and earlier, up to exclusive version 23.3.86.1520.
How can a remote attacker exploit CVE-2023-31452?
A remote attacker can exploit CVE-2023-31452 by inducing a victim user, with an active session, to trigger a malicious request that bypasses the CSRF token.
Are there any fixes available for CVE-2023-31452?
Yes, multiple vulnerabilities including CVE-2023-31452 were fixed in version 23.3.86.1520 of PRTG Network Monitor. It is recommended to update to this version or later to address the issue.