Read the docs
TI-2024-03430 Aliases CVE-2024-3676GHSA-fxxm-g8j5-2w88

Improper input validation in Proofpoint Enterprise Protection

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control.  These accounts are able to send spoofed email to any users within the domains configured by the Administrator.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed Enterprise Protection (Proofpoint): patch 4868, patch 4869, patch 4870 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProofpointEnterprise Protection8.18.6 to before patch 4868; 8.20.0 to before patch 4869; 8.20.2 to before patch 4870; 8.20.4 to before patch 4871; 8.21.0 to before patch 4871patch 4868, patch 4869, patch 4870, patch 4871Patch availableCNA
  • Enterprise Protection VendorProofpoint Affected 8.18.6 to before patch 4868; 8.20.0 to before patch 4869; 8.20.2 to before patch 4870; 8.20.4 to before patch 4871; 8.21.0 to before patch 4871 Fixed in patch 4868, patch 4869, patch 4870, patch 4871 Patch available CNA

CPE names CISA-ADP · 5

CPEVersionsRoleVendor
cpe:2.3:a:proofpoint:enterprise_protection:8.18.6:*:*:*:*:*:*:*8.18.6—Proofpoint
cpe:2.3:a:proofpoint:enterprise_protection:8.20.0:-:*:*:*:*:*:*8.20.0—Proofpoint
cpe:2.3:a:proofpoint:enterprise_protection:8.20.2:*:*:*:*:*:*:*8.20.2—Proofpoint
cpe:2.3:a:prootpoint:enterprise_protection:8.20.4:*:*:*:*:*:*:*8.20.4——
cpe:2.3:a:prootpoint:enterprise_protection:8.21.0:*:*:*:*:*:*:*8.21.0——
  • cpe:2.3:a:proofpoint:enterprise_protection:8.18.6:*:*:*:*:*:*:* Versions 8.18.6 — ·Proofpoint
  • cpe:2.3:a:proofpoint:enterprise_protection:8.20.0:-:*:*:*:*:*:* Versions 8.20.0 — ·Proofpoint
  • cpe:2.3:a:proofpoint:enterprise_protection:8.20.2:*:*:*:*:*:*:* Versions 8.20.2 — ·Proofpoint
  • cpe:2.3:a:prootpoint:enterprise_protection:8.20.4:*:*:*:*:*:*:* Versions 8.20.4 — ·—
  • cpe:2.3:a:prootpoint:enterprise_protection:8.21.0:*:*:*:*:*:*:* Versions 8.21.0 — ·—

Remediation

  • Fix · CNA Enterprise Protection (Proofpoint) Fixed in patch 4868, patch 4869, patch 4870, patch 4871

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Proofpoint Enterprise Protection patch 4868, patch 4869 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-00796 Server-side request forgery in Proofpoint Enterprise ProtectionPriority LOW 22
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3676
  2. 2026-10-03 Alias added: GHSA-fxxm-g8j5-2w88

References

Other 1

  • TI-2020-08565 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1… CVSS 3.1CRITICAL 9.8
  • TI-2020-08563 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1… CVSS 3.1CRITICAL 9.8
  • TI-2020-08562 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1… CVSS 3.1CRITICAL 9.8
  • TI-2020-07138 rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT… CVSS 3.1HIGH 8.8
  • TI-2023-00086 Proofpoint Enterprise Protection webservices unauthenticated RCE CVSS 3.1CRITICAL 9.8
  • TI-2021-17766 Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the… CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences