CVE-2023-5770

HTML injection in email body through email subject

State: Published
Severity: 5.3 Medium
Published: Jan 9, 2024
Updated: Jun 3, 2025
Reserved: Oct 25, 2023

Description

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	Proofpoint

Weaknesses

CWE-838 Inappropriate Encoding for Output Context

Affected Products

Product	Versions
Proofpoint Enterprise ProtectionProofpoint	8.20.2 to before patch 4809Affectedfrom patch 4809Not affected 8.20.0 to before patch 4805Affectedfrom patch 4805Not affected 8.18.6 to before patch 4804Affectedfrom patch 4804Not affected 8.0 to before 8.18.6Affected

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.