CVE-2023-4802 - ITM Server Cross-site Scripting in UpdateInstalledSoftware Endpoint

Back Back to CVE browser

MEDIUM

ITM Server Cross-site Scripting in UpdateInstalledSoftware Endpoint

Published Sep 13, 2023

4.8

MEDIUM

CVSS 3.1

EPSS 0.35%

Description

A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected.

Affected products

Vendor Proofpoint Product ITM Server Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=7.14.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Proofpoint

ITM Server

unaffected

Version	Status	Constraints
0	affected	<=7.14.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0007
Vendor Advisory
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007
Broken Link

Link	Providers	Tags
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0007		Vendor Advisory
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007		Broken Link