A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to obtain sensitive information. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
References
Link | Resource |
---|---|
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004 | Vendor Advisory |
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 | Not Applicable |
Configurations
Configuration 1 (hide)
AND |
|
History
06 Jul 2023, 16:12
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-862 | |
CPE | cpe:2.3:a:proofpoint:insider_threat_management_server:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* |
|
First Time |
Apple
Proofpoint insider Threat Management Server Proofpoint Apple macos |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
References |
|
|
References | (MISC) https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005 - Not Applicable |
27 Jun 2023, 16:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-06-27 15:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-36000
Mitre link : CVE-2023-36000
CVE.ORG link : CVE-2023-36000
JSON object : View
Products Affected
apple
- macos
proofpoint
- insider_threat_management_server
CWE
CWE-862
Missing Authorization