{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-4801", "assignerOrgId": "d83a79dd-e128-4b83-8b64-84faf54eed46", "state": "PUBLISHED", "assignerShortName": "Proofpoint", "dateReserved": "2023-09-06T15:23:18.574Z", "datePublished": "2023-09-13T15:14:36.165Z", "dateUpdated": "2023-09-13T15:14:36.165Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Agent"], "platforms": ["MacOS"], "product": "Insider Threat Management", "vendor": "Proofpoint", "versions": [{"changes": [{"at": "7.14.3.69", "status": "unaffected"}], "lessThanOrEqual": "7.14.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2023-09-13T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected."}], "value": "An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "d83a79dd-e128-4b83-8b64-84faf54eed46", "shortName": "Proofpoint", "dateUpdated": "2023-09-13T15:14:36.165Z"}, "references": [{"url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-006"}], "source": {"discovery": "UNKNOWN"}, "title": "ITM MacOS Agent Improper Certificate Validation", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:proofpoint:insider_threat_management:*:*:*:*:*:macos:*:*", "matchCriteriaId": "9D208A0B-339E-4393-B4C8-418D3ECAD85F", "versionEndExcluding": "7.14.3.69", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected."}, {"lang": "es", "value": "Un actor an\u00f3nimo en una red adyacente podr\u00eda utilizar una vulnerabilidad de validaci\u00f3n de certificaci\u00f3n inadecuada en el agente Insider Threat Management (ITM) para MacOS para establecer una posici\u00f3n intermedia entre el agente y el servidor ITM despu\u00e9s de que el agente se haya registrado. Todas las versiones anteriores a la 7.14.3.69 se ven afectadas. Los agentes para Windows, Linux y Cloud no se ven afectados."}], "id": "CVE-2023-4801", "lastModified": "2023-09-15T19:06:01.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@proofpoint.com", "type": "Secondary"}]}, "published": "2023-09-13T16:15:10.767", "references": [{"source": "nvd@nist.gov", "tags": ["Vendor Advisory"], "url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0006"}, {"source": "security@proofpoint.com", "tags": ["Broken Link"], "url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-006"}], "sourceIdentifier": "security@proofpoint.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-295"}], "source": "security@proofpoint.com", "type": "Secondary"}]}

{}