Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-0431 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CNA: [email protected]CVSS-B:5.8 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2025-0001	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-790	Improper Filtering of Special Elements	[email protected]

Affected Products

Product	Versions
Proofpoint Enterprise Protection	< 8.21.0 patch 5115 < 8.20.6 patch 5114 < 8.18.6 patch 5113
CPE cpe:2.3:a:proofpoint:enterprise_protection:::::::: Remediation Upgrade: 8.21.0 patch 5115moderate effort Upgrade: 8.20.6 patch 5114moderate effort Upgrade: 8.18.6 patch 5113moderate effort

Change History

3 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Mar 19, 2025	New CVE Received	[email protected]