CVE-2021-22158 XML external entity in n/a
An admin with encryption key knowledge can exploit XXE in the Web Console to read sensitive data or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22158?
CVE-2021-22158 is a high-severity vulnerability in n/a, published on 6 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web Console. The vulnerability requires admin user privileges and knowledge of the XML file's encryption key to successfully exploit. All versions before 7.11 are affected.
Weakness: CWE-611
Which versions are affected by CVE-2021-22158?
It affects 1 product.
Products include Proofpoint Insider Threat Management.
How do I fix CVE-2021-22158?
No fix has been published for CVE-2021-22158 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22158 being exploited?
There is no known exploitation of CVE-2021-22158 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x9v6-5m2f-q2hr.