A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
References
| Link | Resource |
|---|---|
| https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 | Not Applicable |
| https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004 | Vendor Advisory |
| https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 | Not Applicable |
Configurations
History
21 Nov 2024, 08:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 - Not Applicable |
06 Jul 2023, 16:02
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | (MISC) https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 - Not Applicable | |
| First Time |
Proofpoint insider Threat Management Server
Proofpoint |
|
| CWE | CWE-862 | |
| CPE | cpe:2.3:a:proofpoint:insider_threat_management_server:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
27 Jun 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-27 15:15
Updated : 2024-11-21 08:09
NVD link : CVE-2023-36002
Mitre link : CVE-2023-36002
CVE.ORG link : CVE-2023-36002
JSON object : View
Products Affected
proofpoint
- insider_threat_management_server
CWE
CWE-862
Missing Authorization