CVE-2023-5770

Published: Jan 9, 2024Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.

Affected (3)

Products: Proofpoint: Enterprise Protection

1 product

Enterprise Protection

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Proofpoint Enterprise Protection	Version 8.18.6
Proofpoint Enterprise Protection	Version 8.20.0
Proofpoint Enterprise Protection	Version 8.20.2

Related CWEs

Inappropriate Encoding for Output Context

The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.

References (2)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009

Source: security@proofpoint.com

Vendor Advisory

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.