CVE-2023-36002 MEDIUM

CVE-2023-36002: ITM Server Missing Authorization for URL validation

Vendor Proofpoint

Product Insider Threat Management

Weakness CWE-862 · Missing authorization

Published June 27, 2023

Last update November 6, 2024

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.

Key dates

02Disclosure timeline

June 27, 2023 CVE published

November 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-36002 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-1860 Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.51 - Missing Authorization to Unauthenticated IP Address Whitelist CVE-2025-68585 WordPress WP Document Revisions plugin <= 3.7.2 - Broken Access Control vulnerability CVE-2025-69363 WordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerability CVE-2025-41339 Missing Authorization vulnerability in CanalDenuncia.app CVE-2024-52395 WordPress Floating Buttons for WooCommerce plugin <= 2.8.8 - Broken Access Control vulnerability