AOH :: HP Unsorted P :: B1A-1224.HTM

Paessler - PRTG Traffic Grapher XSS
Paessler - PRTG Traffic Grapher XSS
Paessler - PRTG Traffic Grapher XSS - Vulnerability Advisory
Release Date:

 Paessler - PRTG Traffic Grapher 

 "PRTG Network Monitor runs 24/7 on a Windows-based machine within your
  network, recording network usage parameters. Recorded data is stored in
  a database for historic reports."

Versions tested:
 Paessler PRTG Traffic Grapher v6.2.1.945

Vulnerability discovered:

 HTML / Javascript Injection (XSS)

Vulnerability impact:

	Medium - If an authenticated user was enticed to visit a malicious
	 URL, it would be possible to steal the authentication cookie etc.

Vulnerability information:

 The 'url' GET parameter of 'login.htm' is vulnerable.



References: advisory 

Patrick Webster ( ) 

Disclosure timeline:
 05-Jan-2009 - Discovered during audit.
 06-Jan-2009 - Notified vendor.
 08-Jan-2009 - Vendor releases update
 08-Jun-2010 - Disclosure.


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to