CVE-2023-35998

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-36008.8During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This v CVE-2023-360006.5A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacke CVE-2023-360024.3A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on CVE-2023-360037.3XAML Diagnostics Elevation of Privilege Vulnerability CVE-2023-360047.5Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability CVE-2023-360058.1Windows Telephony Server Elevation of Privilege Vulnerability CVE-2023-360068.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-360074.1Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability CVE-2023-360086.6Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVE-2023-360095.5Microsoft Word Information Disclosure Vulnerability CVE-2023-36014.3The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbit CVE-2023-360107.5Microsoft Defender Denial of Service Vulnerability