What is CVE-2024-3676?

CVE-2024-3676 is a high-severity vulnerability in Proofpoint Enterprise Protection, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2024-05-14.

How severe is CVE-2024-3676?

High severity. CVSS v3 base score is 7.5 out of 10.

Improper input validation in Proofpoint Enterprise Protection

CVE-2024-3676

The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.004 (29.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Proofpoint Enterprise Protection — versions 8.18.6, 8.20.0, 8.20.2

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

security@proofpoint.com

Frequently asked questions

What is CVE-2024-3676?: CVE-2024-3676 is a high-severity vulnerability in Proofpoint Enterprise Protection, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2024-05-14.
How severe is CVE-2024-3676?: High severity. CVSS v3 base score is 7.5 out of 10.