Description

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected.

Related CPE's

a

proofpoint

insider_threat_management

3

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0005

Vendor Advisory

Weaknesses

[email protected]

Primary
CWE-862

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

8.1 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-04-06T22:15:12.890

4 years ago

Last modified

2021-04-12T16:01:58.577

4 years ago