Vulnerability · Published May 14, 2024 · Assigned by Proofpoint

CVE-2024-3676

High 7.5

In plain English

A high-severity improper input validation in Enterprise Protection from Proofpoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 69.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator.

Affected products (as reported)

Vendor	Product	Versions
Proofpoint	Enterprise Protection	8.18.6 – before patch 48688.20.0 – before patch 48698.20.2 – before patch 48708.20.4 – before patch 48718.21.0 – before patch 4871

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002