CVE-2018-19411

Name of the Vulnerable Software and Affected Versions PRTG Network Monitor versions prior to 18.2.40.1683

Description The issue is related to insecure privilege management, allowing an authenticated user with read-only privileges to create another user with read-write privileges, including administrators. This can be achieved by sending a specially crafted HTTP request to the /api/addusers endpoint, which does not properly check user rights.

Recommendations For versions prior to 18.2.40.1683, update to version 18.2.40.1683 or later to resolve the issue. As a temporary workaround, consider restricting access to the /api/addusers endpoint to prevent exploitation.