CVE-2024-3676
Assigner: Proofpoint
Published: 2024-05-14T19:07:19.420Z
State: PUBLISHED
affected: defaultStatus: affected
product: Enterprise Protection
vendor: Proofpoint
versions: changes: at: patch 4868
status: unaffected
lessThan: patch 4868
status: affected
version: 8.18.6
versionType: semver
changes: at: patch 4869
status: unaffected
lessThan: patch 4869
status: affected
version: 8.20.0
versionType: semver
changes: at: patch 4870
status: unaffected
lessThan: patch 4870
status: affected
version: 8.20.2
versionType: semver
changes: at: patch 4871
status: unaffected
lessThan: patch 4871
status: affected
version: 8.20.4
versionType: semver
changes: at: patch 4872
status: unaffected
lessThan: patch 4871
status: affected
version: 8.21.0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control.&nbsp; These accounts are able to send spoofed email to any users within the domains configured by the Administrator.
value: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control.  These accounts are able to send spoofed email to any users within the domains configured by the Administrator.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev