CVE-2023-36002
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
Risk Assessment
The organization may be exposed to attacks that exploit this vulnerability to smuggle malicious content, potentially leading to data leaks or system compromises.
Recommendation
It is recommended to update the server to version 7.14.3 or newer to mitigate this security vulnerability.
Original NVD description (English source)
A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.