CRITICAL🇵🇱 Wersja polska

CVE-2023-0090

CVSS 9.8v3.1pub. 2023-03-08upd. 2024-11-21

The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all versions 8.20.0 and below.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Proofpoint Enterprise Protection
APP
Proofpoint
8.18.68.20.0< 8.13.228.18.0 – 8.18.4 (bez)

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

CWE

CWE-95

CWE-94

References

www.proofpoint.com/security/security-advisories/pfpt-sa…

Related vulnerabilities

CVE-2022-46332CRITICAL9.6ten sam produkt

The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scri...

CVE-2023-0089HIGH8.8ten sam produkt

The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticat...

CVE-2022-46334HIGH7.8ten sam produkt

Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to r...

CVE-2022-46333HIGH7.2ten sam produkt

The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerabil...

CVE-2021-39304HIGH7.5ten sam produkt

Proofpoint Enterprise Protection before 8.12.0-2108090000 allows security control bypass.