CVE-2024-0862

State: Published
Severity: 5.0 Medium
Published: May 14, 2024
Updated: Aug 20, 2024
Reserved: Jan 24, 2024

Description

The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an authenticated user to relay HTTP requests from the Protection server to otherwise private network addresses.

Scores

CVSS	Score	Vector	Source
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N	Proofpoint

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Enterprise ProtectionProofpoint	8.18.6 to before patch 4868Affectedfrom patch 4868Not affected 8.20.0 to before patch 4869Affectedfrom patch 4869Not affected 8.20.2 to before patch 4870Affectedfrom patch 4870Not affected 8.20.4 to before patch 4871Affectedfrom patch 4871Not affected 8.21.0 to before patch 4871Affectedfrom patch 4872Not affected

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0001

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.