CVE-2024-3676

Published: May 14, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security@proofpoint.com (Secondary)

Description

The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002

Source: security@proofpoint.com

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.