CVE-2023-36002

Published Jun 27, 2023

Last updated 3 months ago

CVSS medium 4.3

Overview

Description: A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
Source: security@proofpoint.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

security@proofpoint.com: CWE-862
nvd@nist.gov: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:proofpoint:insider_threat_management_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "255D6928-4B04-45AB-933C-C8E7557AB56D",
            "versionEndExcluding": "7.14.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References