Bodyclass XSS in Paessler PRTG

Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in Paessler PRTG before version 23.3.86.1520. XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by users, potentially stealing data or performing unauthorized actions.

Useful 0 Not Useful 0

Detection Guidance

Detection of this XSS vulnerability in Paessler PRTG requires checking the installed version against the patched release. Use the PRTG web interface to verify the version number. If the version is below 23.3.86.1520, the system is vulnerable. No specific commands are provided in the resources, but monitoring network traffic for unusual XSS patterns or inspecting PRTG logs for suspicious inputs may help.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in the context of a user's browser session. This may lead to theft of session cookies, credentials, or other sensitive data, or allow the attacker to perform actions on behalf of the user.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles. For HIPAA, it may expose protected health information, risking compliance with security requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update PRTG to version 23.3.86.1520 or later to address the XSS vulnerability in bodyclass. Check the PRTG admin interface for any suspicious channel names or lookup values that may contain malicious scripts.

Useful 0 Not Useful 0