Vulnerability · Published Apr 28, 2025 · Assigned by Proofpoint
CVE-2024-10635Enterprise Protection S/MIME Opaque Signature Attachment Scanning Bypass
Medium 6.1
In plain English
A medium-severity security flaw in Enterprise Protection from Proofpoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attachment scanning security policy by sending a malicious S/MIME attachment with an opaque signature. When opened by a recipient in a downstream email client, the malicious attachment could cause partial loss of integrity and confidentiality to their system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Proofpoint | Enterprise Protection | 8.18.6 – before patch 51108.20.6 – before patch 51348.21.0 – before patch 5112 |
Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N