A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
References
| Link | Resource |
|---|---|
| https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 | Not Applicable |
| https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004 | Vendor Advisory |
| https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 | Not Applicable |
Configurations
History
21 Nov 2024, 08:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 - Not Applicable |
06 Jul 2023, 15:38
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Proofpoint insider Threat Management Server
Proofpoint |
|
| CWE | CWE-862 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.6 |
| CPE | cpe:2.3:a:proofpoint:insider_threat_management_server:*:*:*:*:*:*:*:* | |
| References |
|
|
| References | (MISC) https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 - Not Applicable |
27 Jun 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-27 15:15
Updated : 2024-11-21 08:09
NVD link : CVE-2023-35998
Mitre link : CVE-2023-35998
CVE.ORG link : CVE-2023-35998
JSON object : View
Products Affected
proofpoint
- insider_threat_management_server
CWE
CWE-862
Missing Authorization