CVE-2020-14073

XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can create a map, and then use the Map Designer Properties screen to insert JavaScript code. This can be exploited against any user with View Maps or Edit Maps access.

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

2.86% chance of exploitation in the next 30 days, 87th percentile

Published

2020-06-23

Updated

2024-08-04

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/160312/PRTG-Network-Monitor-20.4.63.1412-Cross-Site-…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/49156

Security advisories

• https://kb.paessler.com/en/topic/88223-what-s-the-open-vulnerability-report-cve-2020-1407…
• https://www.paessler.com/prtg/history/stable
• https://gist.github.com/alert3/e058baa33c31695f4168a1dbf77103df

References

• CVE Record
• NVD entry