CVE-2020-14073: 
PRTG Network Monitor vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in PRTG Network Monitor version 20.1.56.1574. The vulnerability allows an attacker with Read/Write privileges to create a map and inject malicious JavaScript code through the Map Designer Properties screen, which can affect any user with View Maps or Edit Maps access (CVE Mitre, NVD).

The vulnerability exists in the Maps feature of PRTG Network Monitor. An attacker can exploit this by creating a map and using the Map Designer's Properties screen to insert malicious JavaScript code by double-clicking on selected Item HTML elements. The embedded script code would then be executed when other users access the affected map (Paessler KB, GitHub Gist).

The vulnerability affects all users who have access to view or edit maps in PRTG Network Monitor. When exploited, the stored XSS could potentially allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who view the compromised map (Paessler KB).

To exploit this vulnerability, an attacker needs a valid user account with at least read/write permissions to create or edit maps in PRTG. The attack vector requires the ability to access the Map Designer feature and modify map properties (Paessler KB).

According to Paessler, no direct mitigation or workaround is currently possible. Administrators are advised to review user accounts in the PRTG web interface under Setup | System Administration | User Accounts to re-evaluate access rights and remove inactive accounts. Additionally, administrators can monitor map activity through the object history at https://<server>/objecthistory.htm?tabid=9 (Paessler KB).