VulnerabilityModified

CVE-2020-10656

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API.

CRITICAL 9.8EPSS 2.58%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.58% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: proofpoint/insider threat management server
Source: cve@mitre.org

References

https://www.proofpoint.com/us/blogProduct
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2020-0003Vendor Advisory
https://www.proofpoint.com/us/blogProduct
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2020-0003Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.