« Volver al listado

CVE-2024-10635

Estado: ModificadaMedia (5.3)—

Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attachment scanning security policy by sending a malicious S/MIME attachment with an opaque signature. When opened by a recipient in a downstream email client, the malicious attachment could cause partial loss of integrity and confidentiality to their system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Proofpoint — Enterprise Protection

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-10635",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-10635",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-28T22:28:30.982413Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@proofpoint.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@proofpoint.com",
      "affectedData": [
        {
          "vendor": "Proofpoint",
          "product": "Enterprise Protection",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "patch 4868",
                  "status": "unaffected"
                }
              ],
              "version": "8.18.6",
              "lessThan": "patch 5110",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "patch 4871",
                  "status": "unaffected"
                }
              ],
              "version": "8.20.6",
              "lessThan": "patch 5134",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "patch 4872",
                  "status": "unaffected"
                }
              ],
              "version": "8.21.0",
              "lessThan": "patch 5112",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-04-28T21:15:56.427",
  "references": [
    {
      "url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2025-0002",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@proofpoint.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@proofpoint.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attachment scanning security policy by sending a malicious S/MIME attachment with an opaque signature. When opened by a recipient in a downstream email client, the malicious attachment could cause partial loss of integrity and confidentiality to their system."
    },
    {
      "lang": "es",
      "value": "Enterprise Protection contiene una vulnerabilidad de validación de entrada incorrecta en la defensa contra archivos adjuntos que permite a un atacante remoto no autenticado eludir la política de seguridad de escaneo de archivos adjuntos mediante el envío de un archivo adjunto S/MIME malicioso con una firma opaca. Al ser abierto por un destinatario en un cliente de correo electrónico secundario, el archivo adjunto malicioso podría causar una pérdida parcial de la integridad y confidencialidad de su sistema."
    }
  ],
  "lastModified": "2026-06-17T06:56:05.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:proofpoint:enterprise_protection:8.18.6:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79AADBAC-33A4-404F-828D-6758C564A124"
            },
            {
              "criteria": "cpe:2.3:a:proofpoint:enterprise_protection:8.20.6:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDD35655-46C3-487C-ADC7-562A9EA3DBB4"
            },
            {
              "criteria": "cpe:2.3:a:proofpoint:enterprise_protection:8.21.0:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "702F4569-3720-4A2C-98FC-FDE52C5574D5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@proofpoint.com"
}