CVE-2023-5770

mediumpriority · track · 22EPSS 0.003 · 27 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.34% (27th) EPSS

CVSS 5.4 · medium

Is it mine?

7 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.

cvss

Technical severity, 0–10. One row per scoring source.

5.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.5

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · security@proofpoint.comexploitability 3.9 · impact 1.4

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-838USprimary

affected products (7)

Products and version ranges known to be affected.

Proofpoint Enterprise Protection8.0 → 8.18.6enisa_euvdEU
Proofpoint Enterprise Protection8.18.6 → patch 4804enisa_euvdEU
Proofpoint Enterprise Protection8.20.0 → patch 4805enisa_euvdEU
Proofpoint Enterprise Protection8.20.2 → patch 4809enisa_euvdEU
proofpoint enterprise protection= 8.18.6nvdUScpe:2.3:a:proofpoint:enterprise_protection:*:*:*:*:*:*:*:*
proofpoint enterprise protection= 8.20.0nvdUScpe:2.3:a:proofpoint:enterprise_protection:*:*:*:*:*:*:*:*
proofpoint enterprise protection= 8.20.2nvdUScpe:2.3:a:proofpoint:enterprise_protection:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2024-01-09modified 2026-06-17

related (24)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2019-6110US	medium6.8	24.9% (98th)	Exploit	2019-01-31
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for ex…
CVE-2024-52005US	high8.8	0.51% (43rd)	Exploit	2025-01-15
Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the clien…
CVE-2019-18981US	critical9.8	1.39% (72nd)	—	2019-11-15
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CVE-2022-43407US	high8.8	0.61% (49th)	—	2022-10-19
Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that p…
CVE-2020-10996US	high8.1OT elevated	1.54% (75th)	—	2020-04-27
An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transition_key for SST processes in place of the random key ex…

+19 more

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan