CVE-2023-5771

HTML injection in AdminUI through email subject

State: Published
Severity: 6.1 Medium
Published: Nov 6, 2023
Updated: Sep 4, 2024
Reserved: Oct 25, 2023

Description

Proofpoint Enterprise Protection contains a stored XSS vulnerability in the AdminUI. An unauthenticated attacker can send a specially crafted email with HTML in the subject which triggers XSS when viewing quarantined messages. This issue affects Proofpoint Enterprise Protection: from 8.20.0 before patch 4796, from 8.18.6 before patch 4795 and all other prior versions.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Proofpoint

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Proofpoint Enterprise ProtectionProofpoint	8.20.0 to before patch 4796Affectedfrom patch 4796Not affected 8.18.6 to before patch 4795Affectedfrom patch 4795Not affected 8.0 to before 8.18.6Affected

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0010

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.