Vulnerability · Published Jan 9, 2024 · Assigned by Proofpoint
CVE-2023-5770HTML injection in email body through email subject
Medium 5.3
In plain English
A medium-severity security flaw in Proofpoint Enterprise Protection from Proofpoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Official description
Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Proofpoint | Proofpoint Enterprise Protection | 8.20.2 – before patch 48098.20.0 – before patch 48058.18.6 – before patch 48048.0 – before 8.18.6 |
Weakness: CWE-838 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N