CVE-2023-4828 (insider_threat_management)

An improper check for an exceptional condition in the Insider Threat Management (ITM) Server could be used by an attacker to change the configuration of any already-registered agent so that all future agent communications are sent to an attacker-chosen URL. An attacker must first successfully obtain valid agent credentials and target agent hostname. All versions prior to 7.14.3.69 are affected.

agent attacker change check communications configuration credentials cve future insider insider threat insider threat management management server target threat threat management url valid