CVE-2023-4801

An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0006	Vendor Advisory
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-006	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:proofpoint:insider_threat_management:*:*:*:*:*:macos:*:*

History

No history.

Information

Published : 2023-09-13 16:15

Updated : 2023-09-15 19:06

NVD link : CVE-2023-4801

Mitre link : CVE-2023-4801

CVE.ORG link : CVE-2023-4801

JSON object : View

Products Affected

proofpoint

insider_threat_management

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2023-4801", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "security@proofpoint.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2023-09-13T16:15:10.767", "references": [{"url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0006", "tags": ["Vendor Advisory"], "source": "nvd@nist.gov"}, {"url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-006", "tags": ["Broken Link"], "source": "security@proofpoint.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "security@proofpoint.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected."}, {"lang": "es", "value": "Un actor an\u00f3nimo en una red adyacente podr\u00eda utilizar una vulnerabilidad de validaci\u00f3n de certificaci\u00f3n inadecuada en el agente Insider Threat Management (ITM) para MacOS para establecer una posici\u00f3n intermedia entre el agente y el servidor ITM despu\u00e9s de que el agente se haya registrado. Todas las versiones anteriores a la 7.14.3.69 se ven afectadas. Los agentes para Windows, Linux y Cloud no se ven afectados."}], "lastModified": "2023-09-15T19:06:01.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:proofpoint:insider_threat_management:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "9D208A0B-339E-4393-B4C8-418D3ECAD85F", "versionEndExcluding": "7.14.3.69"}], "operator": "OR"}]}], "sourceIdentifier": "security@proofpoint.com"}