CVE-2023-36002

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-360037.3XAML Diagnostics Elevation of Privilege VulnerabilityCVE-2023-360047.5Windows DPAPI (Data Protection Application Programming Interface) Spoofing VulnerabilityCVE-2023-360058.1Windows Telephony Server Elevation of Privilege VulnerabilityCVE-2023-360068.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityCVE-2023-360074.1Microsoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityCVE-2023-360086.6Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-360095.5Microsoft Word Information Disclosure VulnerabilityCVE-2023-36014.3The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitCVE-2023-360107.5Microsoft Defender Denial of Service VulnerabilityCVE-2023-360117.8Win32k Elevation of Privilege VulnerabilityCVE-2023-360125.3DHCP Server Service Information Disclosure VulnerabilityCVE-2023-360136.5PowerShell Information Disclosure Vulnerability