CVE-2024-3676

State: Published
Severity: 7.5 High
Published: May 14, 2024
Updated: Aug 1, 2024
Reserved: Apr 11, 2024

Description

The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	Proofpoint

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Enterprise ProtectionProofpoint	8.18.6 to before patch 4868Affectedfrom patch 4868Not affected 8.20.0 to before patch 4869Affectedfrom patch 4869Not affected 8.20.2 to before patch 4870Affectedfrom patch 4870Not affected 8.20.4 to before patch 4871Affectedfrom patch 4871Not affected 8.21.0 to before patch 4871Affectedfrom patch 4872Not affected

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.