First published: Wed Jun 14 2023(Updated: )
An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker on an adjacent network to obtain credentials to integrated services via a man-in-the-middle position or cryptanalysis of the session traffic. An attacker could use these credentials to impersonate PTR/TRAP to these services. All versions prior to 5.10.0 are affected.
Credit: security@proofpoint.com
Affected Software | Affected Version | How to fix |
---|---|---|
Proofpoint Threat Response Auto Pull | <5.10.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this information disclosure vulnerability in Proofpoint Threat Response is CVE-2023-2820.
The severity of CVE-2023-2820 is medium with a CVSS score of 6.8.
The affected software for CVE-2023-2820 is Proofpoint Threat Response Auto Pull version up to and excluding 5.10.0.
This vulnerability can be exploited by an attacker on an adjacent network to obtain credentials to integrated services via a man-in-the-middle position or cryptanalysis of the session traffic.
Please refer to the vendor's security advisory at https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0003 for information on available patches or mitigations.