Write to Arbitrary Location in Disk Vulnerability in PRTG Network Monitor by Paessler

CVE-2019-11074

What is CVE-2019-11074?

A vulnerability in PRTG Network Monitor allows remote authenticated administrators to execute a specific sequence that results in writing files to arbitrary locations on disk. This occurs due to inadequate input validation when parameters are passed to the phantomjs.exe executable. Although attackers cannot control the contents of the written files, the ability to place files in sensitive directories poses serious security risks. Administrators must create a new HTTP Full Web Page Sensor with certain configurations to exploit this flaw, making it imperative to apply relevant security updates.

References