CVE-2023-36002

MEDIUM

Insider Threat Management Server <7.14.3 - SSRF

Title source: llm
STIX 2.1

Description

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.

References (2)

Core 2

Scores

CVSS v3 4.3
EPSS 0.0025
EPSS Percentile 16.7%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
proofpoint/insider_threat_management_server < 7.14.3
Published Jun 27, 2023
Tracked Since Feb 18, 2026