Lucene search

ProofpointCVE-2022-46332

HistoryDec 06, 2022 - 8:15 p.m.

CVE-2022-46332

2022-12-0620:15:10

CWE-79

Proofpoint

web.nvd.nist.gov

cve-2022-46332

admin smart search

proofpoint enterprise protection

pps

pod

stored xss

vulnerability

security

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.002

Percentile

58.4%

JSON

The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain admin privileges within the user interface. This affects all versions 8.19.0 and below.

Affected configurations

Nvd

Node

proofpointenterprise_protectionRange≤8.19.0

VendorProductVersionCPE
proofpointenterprise_protection*cpe:2.3:a:proofpoint:enterprise_protection:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
proofpoint	enterprise_protection	*	cpe:2.3:a:proofpoint:enterprise_protection::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "enterprise_protection",
    "vendor": "proofpoint",
    "versions": [
      {
        "changes": [
          {
            "at": "8.19.0 patch 4546",
            "status": "unaffected"
          },
          {
            "at": "8.18.6 patch 4545",
            "status": "unaffected"
          },
          {
            "at": "8.18.4 patch 4544",
            "status": "unaffected"
          },
          {
            "at": "8.13.22 patch 4543",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "8.19.0",
        "status": "affected",
        "version": "8.*",
        "versionType": "semver"
      }
    ]
  }
]

References

www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0002

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.002

Percentile

58.4%

JSON

Related for CVE-2022-46332