PT-2022-27824 · Proofpoint · Proofpoint Enterprise Protection

Ly1G3 · Published 2022-12-06 · Updated 2022-12-09 · CVE-2022-46332

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Proofpoint Enterprise Protection (PPS/PoD) versions 8.19.0 and below

Description The Admin Smart Search feature in Proofpoint Enterprise Protection contains a stored cross-site scripting issue that allows an anonymous email sender to gain admin privileges within the user interface.

Recommendations For versions 8.19.0 and below, update to a version above 8.19.0 to resolve the issue. As a temporary workaround, consider restricting access to the Admin Smart Search feature until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-46332

Affected Products

Proofpoint Enterprise Protection

References · 4

• https://proofpoint.com/security/security-advisories/pfpt-sa-2022-0002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46332 · Security Note
• https://t.me/cibsecurity/54097 · Telegram Post