Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.
References
Link | Resource |
---|---|
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
18 Jan 2024, 15:54
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009 - Vendor Advisory | |
CWE | CWE-838 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
CPE | cpe:2.3:a:proofpoint:enterprise_protection:8.18.6:*:*:*:*:*:*:* cpe:2.3:a:proofpoint:enterprise_protection:8.20.2:*:*:*:*:*:*:* cpe:2.3:a:proofpoint:enterprise_protection:8.20.0:*:*:*:*:*:*:* |
|
First Time |
Proofpoint
Proofpoint enterprise Protection |
09 Jan 2024, 22:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-01-09 22:15
Updated : 2024-02-28 20:54
NVD link : CVE-2023-5770
Mitre link : CVE-2023-5770
CVE.ORG link : CVE-2023-5770
JSON object : View
Products Affected
proofpoint
- enterprise_protection
CWE
CWE-838
Inappropriate Encoding for Output Context