CVE-2023-35998
Assigner: Proofpoint
Published: 2023-06-27T14:30:53.460Z
State: PUBLISHED
affected: defaultStatus: unaffected
modules: Server
product: Insider Threat Management
vendor: Proofpoint
versions: lessThan: 7.14.3
status: affected
version: 0
versionType: semver
datePublic: 2023-06-25T14:25:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
value: A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
source: discovery: UNKNOWN
title: ITM Server Missing Authorization in SOAP Endpoints
x_generator: engine: Vulnogram 0.1.0-dev