CVE-2023-5770: HTML injection in email body through email subject

First published: Tue Jan 09 2024(Updated: )

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.

Credit: security@proofpoint.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/references
• agent/weakness
• agent/author
• agent/description
• collector/epss-latest
• source/FIRST
• agent/epss
• collector/nvd-api
• source/NVD
• agent/software-canonical-lookup
• agent/softwarecombine
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/severity
• agent/title
• agent/first-publish-date
• agent/tags
• agent/event
• vendor/proofpoint
• canonical/proofpoint enterprise protection
• version/proofpoint enterprise protection/8.18.6
• version/proofpoint enterprise protection/8.20.0
• version/proofpoint enterprise protection/8.20.2