Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"
CVE-2022-46332

9.6CRITICAL

Key Information:

Vendor: Proofpoint
Status: Enterprise Protection
Vendor: CVE Published:; 6 December 2022

Summary

The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain admin privileges within the user interface. This affects all versions 8.19.0 and below.

Affected Version(s)

enterprise_protection 8.* <= 8.19.0

References

https://www.proofpoint.com/security/security-advisories/p...

vendor-advisory

CVSS V3.1

Score:

9.6

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Dec 6, 2022
Vulnerability Reserved
Nov 29, 2022

Credit

ly1g3