Lucene search

ProofpointCVELIST:CVE-2022-46332

HistoryDec 06, 2022 - 7:52 p.m.

CVE-2022-46332 Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"

2022-12-0619:52:02

CWE-79

Proofpoint

www.cve.org

proofpoint

enterprise protection

xss

admin

smart search

vulnerability

anonymous email sender

admin privileges

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

58.4%

JSON

The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain admin privileges within the user interface. This affects all versions 8.19.0 and below.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "enterprise_protection",
    "vendor": "proofpoint",
    "versions": [
      {
        "changes": [
          {
            "at": "8.19.0 patch 4546",
            "status": "unaffected"
          },
          {
            "at": "8.18.6 patch 4545",
            "status": "unaffected"
          },
          {
            "at": "8.18.4 patch 4544",
            "status": "unaffected"
          },
          {
            "at": "8.13.22 patch 4543",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "8.19.0",
        "status": "affected",
        "version": "8.*",
        "versionType": "semver"
      }
    ]
  }
]

References

www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0002

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

58.4%

JSON

Related for CVELIST:CVE-2022-46332