CVE-2023-2819

Published: Jun 14, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.2 / Impact: 2.7

Source: NVD

Description

A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allow an authenticated administrator on an adjacent network to replace the image file with an arbitrary MIME type.  This could result in arbitrary javascript code execution in an admin context. All versions prior to 5.10.0 are affected. 

Affected (1)

Products: Proofpoint: Threat Response Auto Pull

1 product

Threat Response Auto Pull

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Proofpoint Threat Response Auto Pull	Before 5.10.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0002

Source: security@proofpoint.com

Vendor Advisory

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0002

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.