CVE-2023-4802

Published: Sep 13, 2023Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected.

Affected (1)

Products: Proofpoint: Insider Threat Management

1 product

Insider Threat Management

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Proofpoint Insider Threat Management	Before 7.14.3.69

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007

Source: security@proofpoint.com

Broken Link

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0007

Source: nvd@nist.gov

Vendor Advisory

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.