CVE-2023-36002

Published: Jun 27, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.

Affected (1)

Products: Proofpoint: Insider Threat Management Server

Proofpoint

1 product

Insider Threat Management Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Proofpoint Insider Threat Management Server	Before 7.14.3

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005

Source: security@proofpoint.com

Not Applicable

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004

Source: nvd@nist.gov

Vendor Advisory

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

Timeline

No history available yet.