CVE-2023-5770 HTML injection in email body through email subject

Medium 5.3 Published 9 Jan 2024 Updated 3 Jun 2025

An unauthenticated attacker can inject HTML into email bodies via the subject line, potentially enabling XSS attacks against recipients of Proofpoint Enterprise Protection.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-5770?

CVE-2023-5770 is a medium-severity cross-site scripting vulnerability in Proofpoint Enterprise Protection, published on 9 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.

Weakness: CWE-838

Which versions are affected by CVE-2023-5770?

It affects 1 product.

Products include Proofpoint Enterprise Protection.

How do I fix CVE-2023-5770?

No fix has been published for CVE-2023-5770 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-5770 being exploited?

There is no known exploitation of CVE-2023-5770 in the wild and no public exploit code.

Sources

Also known as GHSA-q8q6-ccrm-hrm9.