The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all versions 8.20.0 and below.
References
| Link | Resource |
|---|---|
| https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001 | Vendor Advisory |
| https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001 - Vendor Advisory |
12 Jul 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all versions 8.20.0 and below. |
15 Mar 2023, 13:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:proofpoint:enterprise_protection:8.18.6:*:*:*:*:*:*:* cpe:2.3:a:proofpoint:enterprise_protection:*:*:*:*:*:*:*:* cpe:2.3:a:proofpoint:enterprise_protection:8.20.0:*:*:*:*:*:*:* |
|
| References | (MISC) https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001 - Vendor Advisory | |
| CWE | CWE-94 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
08 Mar 2023, 13:55
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-08 01:15
Updated : 2024-11-21 07:36
NVD link : CVE-2023-0090
Mitre link : CVE-2023-0090
CVE.ORG link : CVE-2023-0090
JSON object : View
Products Affected
proofpoint
- enterprise_protection