CVE-2023-2818 ITM Windows Agent Insecure Filesystem Permissions

What is CVE-2023-2818?

CVE-2023-2818 is a medium-severity vulnerability in Proofpoint Insider Threat Management, published on 27 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected.

Weakness: CWE-281

Which versions are affected by CVE-2023-2818?

It affects 1 product.

Products include Proofpoint Insider Threat Management.

How do I fix CVE-2023-2818?

No fix has been published for CVE-2023-2818 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-2818 being exploited?

There is no known exploitation of CVE-2023-2818 in the wild and no public exploit code.

Other vulnerabilities in Proofpoint Insider Threat Management

• CVE-2020-8884 Deserialization in n/a High 8.8
• CVE-2021-27900 Missing authorization in n/a High 8.1
• CVE-2022-25294 Privilege escalation in n/a High 7.8
• CVE-2021-22159 Missing authorization in n/a High 7.8
• CVE-2023-4801 ITM MacOS Agent Improper Certificate Validation High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gm3h-h75w-r3wg.