Enterprise Protection Backslash URL Rewrite Bypass
Priority LOW 32CWE-790Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed Enterprise Protection (Proofpoint): patch 5113, patch 5114, patch 5115
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Proofpoint | Enterprise Protection | 8.18.6 to before patch 5113; 8.20.6 to before patch 5114; 8.21.0 to before patch 5115 | patch 5113, patch 5114, patch 5115 | Patch available | CNA |
- Enterprise Protection VendorProofpoint Affected 8.18.6 to before patch 5113; 8.20.6 to before patch 5114; 8.21.0 to before patch 5115 Fixed in patch 5113, patch 5114, patch 5115 Patch available CNA
Remediation
- Fix · CNA Enterprise Protection (Proofpoint) Fixed in patch 5113, patch 5114, patch 5115
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0431
- 2026-10-03 Alias added: GHSA-hqgf-xpw9-m8hc
More Proofpoint vulnerabilities
- TI-2020-08565 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1… CVSS 3.1CRITICAL 9.8
- TI-2020-08563 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1… CVSS 3.1CRITICAL 9.8
- TI-2020-08562 The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1… CVSS 3.1CRITICAL 9.8
- TI-2020-07138 rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT… CVSS 3.1HIGH 8.8
- TI-2023-00086 Proofpoint Enterprise Protection webservices unauthenticated RCE CVSS 3.1CRITICAL 9.8
- TI-2021-17766 Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-0431 · CVE Program
- CVE-2025-0431 · NVD
- FIRST EPSS
- GHSA-hqgf-xpw9-m8hc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences