← Zuruck zu CVEs

CVE-2021-40842

CRITICAL

9.8

Beschreibung

Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the server could be used to blindly execute arbitrary SQL statements on the backend database. Version 7.12.0 and all versions prior to 7.11.2 are affected.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht10/13/2021

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

proofpoint:insider_threat_management_server

Schwachen (CWE)

CWE-89

Referenzen

https://www.proofpoint.com/us/security/security-advisories(cve@mitre.org)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0008(cve@mitre.org)

https://www.proofpoint.com/us/security/security-advisories(af854a3a-2127-422b-91ae-364da2661108)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0008(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.