CVE-2025-0431

Enterprise Protection Backslash URL Rewrite Bypass

State: Published
Severity: 5.8 Medium
Published: Mar 19, 2025
Updated: Mar 19, 2025
Reserved: Jan 13, 2025

Description

Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N	Proofpoint

Weaknesses

CWE-790 Improper Filtering of Special Elements

Affected Products

Product	Versions
Enterprise ProtectionProofpoint	8.18.6 to before patch 5113Affectedfrom patch 5113Not affected 8.20.6 to before patch 5114Affectedfrom patch 5114Not affected 8.21.0 to before patch 5115Affectedfrom patch 5115Not affected

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2025-0001

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.