CVE-2023-35998 MEDIUM

CVE-2023-35998: ITM Server Missing Authorization in SOAP Endpoints

Vendor Proofpoint

Product Insider Threat Management

Weakness CWE-862 · Missing authorization

Published June 27, 2023

Last update November 6, 2024

View on NVD All CVEs

CVSS base score

4.6/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.

Key dates

02Disclosure timeline

June 27, 2023 CVE published

November 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-35998 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-12616 Bitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update CVE-2025-13440 Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion CVE-2025-31798 WordPress Publitio Plugin <= 2.1.8 - Broken Access Control vulnerability CVE-2025-31856 WordPress Export All Post Meta Plugin <= 1.2.1 - Broken Access Control vulnerability CVE-2025-67583 WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerability