CVE-2023-2819: Proofpoint Threat Response / Threat Response Auto Pull (PTR/TRAP) Cross Site Scripting in Sources UI | Proofpoint US

Proofpoint Threat Response / Threat Response Auto Pull (PTR/TRAP) Cross Site Scripting in Sources UI, CVE-2023-2819

Advisory ID: PFPT-SA-2023-0002

A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allow an authenticated administrator on an adjacent network to replace the image file with an arbitrary MIME type.  This could result in arbitrary javascript code execution in an admin context. All versions prior to 5.10.0 are affected.

****Vulnerability Information** **

This vulnerability is identified by CVE-2023-2819. Proofpoint has released patches to address this issue. If you are running a known vulnerable release, please update to a fully supported version as soon as possible.

This vulnerability has been assigned a CVSS score of 4.3 (CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

****Fixed Software** **

Proofpoint has released fixed software version 5.10.0.

The fixed software versions are available through the customer support portal.

****URL****

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0002

**Revision History **

Version

Description

Section

Date

1.0

Initial release

Advisory

June 14, 2023

****Legal Disclaimer** **

THIS DOCUMENT IS PROVIDED ON AN “AS IS” BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. PROOFPOINT RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for authorized subscribers to Proofpoint products and services.