CVE Feed

    Dashboard / CVE / CVE-2021-40842

    CVE-2021-40842

    Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the server could be used to blindly execute arbitrary SQL statements on the backend database. Version 7.12.0 and all versions prior to 7.11.2 are affected.

    Published:Oct 13, 2021
    Last Modified:Nov 21, 2024
    EPS:Oct 13, 2021
    EPSS Score:0.00639
    CVSS Score:9.8

    Affected Products

    Vendor
    Proofpoint
    Product
    Insider Threat Management Server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-8558 (CVSS 2.3) — Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability…
    CVE-2023-4828 (CVSS 6.4) — An improper check for an exceptional condition in the Insider Threat Management (ITM) Server could be used by …
    CVE-2023-36002 (CVSS 4.3) — A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server ena…
    CVE-2023-36000 (CVSS 6.5) — A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Serve…
    CVE-2023-35998 (CVSS 4.6) — A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an at…
    CVE-2021-40843 (CVSS 7.3) — Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Consol…
    CVE-2020-10658 (CVSS 9.8) — The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerabil…
    CVE-2020-10657 (CVSS 7.2) — The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerabil…
    CVE-2020-10656 (CVSS 9.8) — The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerabil…
    CVE-2020-10655 (CVSS 9.8) — The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerabil…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High