The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• proofpoint insider threat management7.9.0 and later · before 7.9.3
• proofpoint insider threat management7.10.0 and later · before 7.10.3
• proofpoint insider threat management7.11.0 and later · before 7.11.1

Other highest-scoring records for the same primary product.

• CVE-2020-8884rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated u
  36Monitor
• CVE-2021-27900The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Co
  33Monitor
• CVE-2022-25294Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Wi
  31Monitor
• CVE-2021-22159Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management (formerly ObserveI
  31Monitor
• CVE-2023-4801ITM MacOS Agent Improper Certificate Validation
  30Monitor
• CVE-2021-27899The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server
  29Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.