CVEvulnerability
CVE-2021-40842
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-10-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the server could be used to blindly execute arbitrary SQL statements on the backend database. Version 7.12.0 and all versions prior to 7.11.2 are affected.
Affected configurations
• proofpoint insider threat management server (< 7.11.2)
• proofpoint insider threat management server 7.12.0
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://www.proofpoint.com/us/security/security-advisories Vendor Advisory
- https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0008 Vendor Advisory
- https://www.proofpoint.com/us/security/security-advisories Vendor Advisory
- https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0008 Vendor Advisory