Lucene search

ProofpointVULNRICHMENT:CVE-2023-4803

HistorySep 13, 2023 - 3:15 p.m.

CVE-2023-4803 ITM Server Cross-site Scripting in WriteWindowTitle Endpoint

2023-09-1315:15:40

CWE-79

Proofpoint

github.com

itm server

cross-site scripting

writewindowtitle

insider threat management

web console

administrator

vulnerability

version 7.14.3.69

cve-2023-4803

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server’s web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator’s browser. All versions prior to 7.14.3.69 are affected.

References

www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007