CVE-2023-36002

4.3 mediumEPSS 0.3%

Medium (4.3) in proofpoint insider threat management server. EPSS 0.3% chance of exploitation in the next 30 days.

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2023-06-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

proofpoint:insider_threat_management_server

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005

Check your stack JSON