CVE-2023-36000

Published: Jun 27, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to obtain sensitive information. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.

Affected (1)

Products: Proofpoint: Insider Threat Management Server

1 product

Insider Threat Management Server

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Proofpoint Insider Threat Management Server	Before 7.14.3

Running on/with	Platform Versions
Apple Macos	All versions

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005

Source: security@proofpoint.com

Not Applicable

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004

Source: nvd@nist.gov

Vendor Advisory

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

Timeline

No history available yet.