CVE-2023-36002

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
ProofpointCNA
4.3 MEDIUM
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Affected Products (NVD)
VendorProductVersion
proofpointinsider_threat_management_server
𝑥
< 7.14.3
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
proofpointinsider_threat_management
𝑥
< 7.14.3
CNA
Common Weakness Enumeration
References
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005