CVE-2023-0089
Assigner: Proofpoint
Published: 2023-03-08T00:27:25.544Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: enterprise_protection
vendor: proofpoint
versions: changes: at: 8.20.0 patch 4570
status: unaffected
at: 8.18.6 patch 4568
status: unaffected
at: 8.18.4 patch 4567
status: unaffected
at: 8.13.22 patch 4566
status: unaffected
lessThanOrEqual: 8.20.0
status: affected
version: 8.*
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: ly1g3
datePublic: 2023-03-07T20:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <p></p><p>The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'.</p><p>This affects all versions 8.20.0 and below. </p><p></p><p></p>
value: 
The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'.

This affects all versions 8.20.0 and below. 






metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
type: CWE
source: discovery: UNKNOWN
title: Proofpoint Enterprise Protection webutils authenticated RCE
x_generator: engine: Vulnogram 0.1.0-dev