Unsafe Deserialization Vulnerability in Proofpoint Insider Threat Management Server

CVE-2021-40843

Summary

Proofpoint Insider Threat Management Server is vulnerable to an unsafe deserialization flaw within its Web Console. This security weakness allows an attacker with write access to the local database to execute arbitrary code with SYSTEM privileges on the server whenever a Web Console user attempts to retrieve that data. Furthermore, when this vulnerability is combined with a SQL injection weakness, it presents an opportunity for remote exploitation, particularly if users interact with a series of maliciously crafted URLs.

References