CVE-2025-0431

MEDIUM

Enterprise Protection Backslash URL Rewrite Bypass

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-0431 has a selected CVSS score of 5.8 (medium).

Description

Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Enterprise Protection

Browse Proofpoint / Enterprise Protection

Default status: affected

CVE List8.18.6 to < patch 5113affected
8.20.6 to < patch 5114affected
8.21.0 to < patch 5115affected

References

2