CVE-2023-0090 CRITICAL

CVE-2023-0090: Proofpoint Enterprise Protection webservices unauthenticated RCE

Vendor Proofpoint
Product enterprise_protection
Weakness CWE-95 · Eval injection
Published March 8, 2023
Last update February 28, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all versions 8.20.0 and below.

Key dates

02Disclosure timeline

March 8, 2023 CVE published
February 28, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet CVE-2025-15551 LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N CVE-2020-6650 Arbitrary code execution through “Update Manager” Class CVE-2022-36100 XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection