References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Known Affected Software Configurations Switch to CPE 2.2

Change History

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009

NIST AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

NIST CWE-838

OR
     *cpe:2.3:a:proofpoint:enterprise_protection:8.18.6:*:*:*:*:*:*:*
     *cpe:2.3:a:proofpoint:enterprise_protection:8.20.0:*:*:*:*:*:*:*
     *cpe:2.3:a:proofpoint:enterprise_protection:8.20.2:*:*:*:*:*:*:*

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009 No Types Assigned

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009 Vendor Advisory

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject.  The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.

Proofpoint Inc. AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Proofpoint Inc. CWE-838

Proofpoint Inc. https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009 [No types assigned]