CVE-2023-36002

Published Jun 27, 2023

Last updated a year ago

CVSS medium 4.3

Overview

Description: A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
Source: security@proofpoint.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-862
security@proofpoint.com: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:proofpoint:insider_threat_management_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "255D6928-4B04-45AB-933C-C8E7557AB56D",
            "versionEndExcluding": "7.14.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References