CVE-2023-4801 ITM MacOS Agent Improper Certificate Validation
An attacker on an adjacent network can perform man-in-the-middle attacks against the Proofpoint ITM MacOS agent due to improper certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4801?
CVE-2023-4801 is a high-severity vulnerability in Proofpoint Insider Threat Management, published on 13 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected.
Weakness: CWE-295
Which versions are affected by CVE-2023-4801?
It affects 1 product.
Products include Proofpoint Insider Threat Management.
How do I fix CVE-2023-4801?
No fix has been published for CVE-2023-4801 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4801 being exploited?
There is no known exploitation of CVE-2023-4801 in the wild and no public exploit code.
Other vulnerabilities in Proofpoint Insider Threat Management
Sources
Also known as GHSA-fj9m-2hq3-2ghm.