An improper check for an exceptional condition in the Insider Threat Management (ITM) Server could be used by an attacker to change the configuration of any already-registered agent so that all future agent communications are sent to an attacker-chosen URL. An attacker must first successfully obtain valid agent credentials and target agent hostname. All versions prior to 7.14.3.69 are affected.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-4828
• https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-008
• https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0008