CVE-2019-11074: 
PRTG Network Monitor vulnerability analysis and mitigation

A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary locations with SYSTEM privileges (although not controlling the contents of such files) due to insufficient sanitization when passing arguments to the phantomjs.exe binary. In order to exploit the vulnerability, remote authenticated administrators need to create a new HTTP Full Web Page Sensor and set specific settings when executing the sensor (NVD).

The vulnerability has a CVSS v3.1 Base Score of 7.2 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The issue stems from insufficient sanitization of arguments passed to the phantomjs.exe binary when creating and executing an HTTP Full Web Page Sensor. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

The vulnerability allows attackers with administrative privileges to write files to arbitrary locations on the system with SYSTEM level privileges. While attackers cannot control the contents of these files directly, the ability to place files in arbitrary locations with elevated privileges poses a significant security risk (NVD).

The vulnerability requires an authenticated administrator account to exploit. The attacker needs to create a new HTTP Full Web Page Sensor and configure specific settings during sensor execution to trigger the vulnerability. The attack can be performed remotely if the attacker has the necessary administrative access (NVD).

The vulnerability was fixed in PRTG version 19.3.51/19.4.52. Users should upgrade to these versions or later to address the security issue. The fix was released as part of a security update that addressed multiple vulnerabilities (How2ITSec).