CVE-2022-46332

Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"

State: Published
Severity: 9.6 Critical
Published: Dec 6, 2022
Updated: Apr 23, 2025
Reserved: Nov 29, 2022

Description

The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain admin privileges within the user interface. This affects all versions 8.19.0 and below.

Scores

CVSS	Score	Vector	Source
3.1	9.6 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	Proofpoint

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
enterprise_protectionproofpoint	8.* through 8.19.0Affectedfrom 8.19.0 patch 4546Not affectedfrom 8.18.6 patch 4545Not affectedfrom 8.18.4 patch 4544Not affectedfrom 8.13.22 patch 4543Not affected

References

https://www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0002vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.