CVE-2022-46333

Proofpoint Enterprise Protection perl eval() arbitrary command execution

State: Published
Severity: 7.2 High
Published: Dec 6, 2022
Updated: Apr 23, 2025
Reserved: Nov 29, 2022

Description

The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands beyond their allowed scope. This affects all versions 8.19.0 and below.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	Proofpoint

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
enterprise_protectionproofpoint	8.* through 8.19.0Affectedfrom 8.19.0 patch 4546Not affectedfrom 8.18.6 patch 4545Not affectedfrom 8.18.4 patch 4544Not affectedfrom 8.13.22 patch 4543Not affected

References

https://www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0003vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.