VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Oct 13, 2021· Updated Jun 17, 2026

CVE-2021-40842

CVE-2021-40842

Description

Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the server could be used to blindly execute arbitrary SQL statements on the backend database. Version 7.12.0 and all versions prior to 7.11.2 are affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Proofpoint/Insider Threat Management Server2 versions
    cpe:2.3:a:proofpoint:insider_threat_management_server:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:proofpoint:insider_threat_management_server:*:*:*:*:*:*:*:*range: <7.11.2
    • cpe:2.3:a:proofpoint:insider_threat_management_server:7.12.0:*:*:*:*:*:*:*
  • Proofpoint/Insider Threat Management Serverdescription
  • Proofpoint/Insider Threat Management Agentllm-fuzzy
    Range: <7.12.0, >=7.11.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.

CVE-2021-40842 · Critical · VYPR