Vulnerability Details : CVE-2020-14073
XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can create a map, and then use the Map Designer Properties screen to insert JavaScript code. This can be exploited against any user with View Maps or Edit Maps access.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2020-14073
Probability of exploitation activity in the next 30 days: 0.68%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 79 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2020-14073
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST |
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
2.3
|
2.7
|
NIST |
CWE ids for CVE-2020-14073
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-14073
-
https://gist.github.com/alert3/e058baa33c31695f4168a1dbf77103df
PRTG Network Monitor - 20.1.56.1574 X64 - Stored XSS · GitHubExploit;Third Party Advisory
-
http://packetstormsecurity.com/files/160312/PRTG-Network-Monitor-20.4.63.1412-Cross-Site-Scripting.html
PRTG Network Monitor 20.4.63.1412 Cross Site Scripting ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://kb.paessler.com/en/topic/88223-what-s-the-open-vulnerability-report-cve-2020-14073-that-my-security-tracker-informed-me-about
What's the open vulnerability report CVE-2020-14073 that my security tracker informed me about? | Paessler Knowledge BaseVendor Advisory
-
https://www.paessler.com/prtg/history/stable
Paessler AG - Version HistoryRelease Notes;Vendor Advisory
Products affected by CVE-2020-14073
- cpe:2.3:a:paessler:prtg_network_monitor:20.1.56.1574:*:*:*:*:*:*:*