CVE-2023-0090

CRITICAL

Proofpoint Enterprise Protection <8.20.0 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-0090. PoCs published by ly1g3.

AI-analyzed exploit summary Unauthenticated remote code execution in Proofpoint Messaging Security Gateway via unsanitized user input in `Webservices.pm`. The exploit leverages Perl's `eval` to execute arbitrary code by manipulating the `$module` variable derived from the URI path.

Description

The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all versions 8.20.0 and below.

Exploits (1)

nomisec WORKING POC 1 stars
by ly1g3 · poc
https://github.com/ly1g3/proofpoint-CVE-2023-0090

Unauthenticated remote code execution in Proofpoint Messaging Security Gateway via unsanitized user input in `Webservices.pm`. The exploit leverages Perl's `eval` to execute arbitrary code by manipulating the `$module` variable derived from the URI path.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Proofpoint Messaging Security Gateway 8.18.4.73
No auth needed
Prerequisites: WebServices API must be enabled in the target's settings · Network access to the target on port 10010
mistral-large-3 · analyzed Jul 08, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0074
EPSS Percentile 51.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94 CWE-95
Status published
Products (3)
proofpoint/enterprise_protection 8.18.6
proofpoint/enterprise_protection 8.20.0
proofpoint/enterprise_protection < 8.13.22
Published Mar 08, 2023
Tracked Since Feb 18, 2026