CVE-2023-31448

A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions could trick the HL7 sensor into behaving differently for existing files and non-existing files. This made it possible to traverse paths, allowing the sensor to execute files outside the designated custom sensors folder. The severity of this vulnerability is medium and received a score of 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

• CWE-22

• https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520Vendor Advisory
• https://www.paessler.com/prtg/history/stableRelease Notes
• https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520Vendor Advisory
• https://www.paessler.com/prtg/history/stableRelease Notes

Published

Aug 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31441In NATO Communications and Information Agency anet (aka Advi…5.5
• CVE-2023-31442In Lightbend Akka before 2.8.1, the async-dns resolver (used…7.5
• CVE-2023-31444In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-…7.5
• CVE-2023-31445Cassia Access controller before 2.1.1.2203171453, was discov…5.3
• CVE-2023-31446In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC200…9.8
• CVE-2023-31447user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (…9.8
• CVE-2023-31449A path traversal vulnerability was identified in the WMI Cus…4.7
• CVE-2023-3145A vulnerability, which was classified as critical, has been …8.8
• CVE-2023-31450A path traversal vulnerability was identified in the SQL v2 …4.7
• CVE-2023-31452A cross-site request forgery (CSRF) token bypass was identif…8.8
• CVE-2023-31453Incorrect Permission Assignment for Critical Resource Vulner…7.5
• CVE-2023-31454Incorrect Permission Assignment for Critical Resource Vulner…7.5