TI-2023-05308 Aliases CVE-2023-5770 GHSA-q8q6-ccrm-hrm9

HTML injection in email body through email subject

LOW 30CWE-838Published 2024-01-09 · Updated 2025-06-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0034 27th percentileScored 2026-11-07

Fix Fixed Proofpoint Enterprise Protection (Proofpoint): patch 4809, patch 4805, patch 4804

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Proofpoint	Proofpoint Enterprise Protection	8.20.2 to before patch 4809; 8.20.0 to before patch 4805; 8.18.6 to before patch 4804; 8.0 to before 8.18.6	patch 4809, patch 4805, patch 4804	Patch available	CNA

Proofpoint Enterprise Protection VendorProofpoint Affected 8.20.2 to before patch 4809; 8.20.0 to before patch 4805; 8.18.6 to before patch 4804; 8.0 to before 8.18.6 Fixed in patch 4809, patch 4805, patch 4804 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:proofpoint:enterprise_protection:8.18.6:::::::*	8.18.6	Vulnerable	Proofpoint
cpe:2.3:a:proofpoint:enterprise_protection:8.20.0:::::::*	8.20.0	Vulnerable	Proofpoint
cpe:2.3:a:proofpoint:enterprise_protection:8.20.2:::::::*	8.20.2	Vulnerable	Proofpoint

cpe:2.3:a:proofpoint:enterprise_protection:8.18.6:*:*:*:*:*:*:* Versions 8.18.6 Vulnerable ·Proofpoint
cpe:2.3:a:proofpoint:enterprise_protection:8.20.0:*:*:*:*:*:*:* Versions 8.20.0 Vulnerable ·Proofpoint
cpe:2.3:a:proofpoint:enterprise_protection:8.20.2:*:*:*:*:*:*:* Versions 8.20.2 Vulnerable ·Proofpoint

Remediation

Fix · CNA Proofpoint Enterprise Protection (Proofpoint) Fixed in patch 4809, patch 4805, patch 4804

Timeline

2026-10-02 Threatist record created from CVE-2023-5770
2026-10-03 Alias added: GHSA-q8q6-ccrm-hrm9

References

Advisory 1

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009

TI-2023-00086 Proofpoint Enterprise Protection webservices unauthenticated RCE CVSS 3.1CRITICAL 9.8
TI-2022-22879 Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names" CVSS 3.1CRITICAL 9.6
TI-2023-00085 Proofpoint Enterprise Protection webutils authenticated RCE CVSS 3.1HIGH 8.8
TI-2019-14178 A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD)… CVSS 3.1HIGH 8.8
TI-2022-22880 Proofpoint Enterprise Protection perl eval() arbitrary command execution CVSS 3.1HIGH 7.2
TI-2022-22881 Proofpoint Enterprise Protection Local Privilege Escalation CVSS 3.1HIGH 7.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences