Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2023-5770

HTML injection in email body through email subject

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Proofpoint

Description

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Proofpoint Proofpoint Enterprise Protection

Default version status: affected

  • 8.20.2 to < patch 4809affected
  • 8.20.0 to < patch 4805affected
  • 8.18.6 to < patch 4804affected
  • 8.0 to < 8.18.6affected

References