CVE-2019-20634

LOW 3.7CVE-2019-20634 · Published 30/03/2020 · updated 17/06/2026

In short

CVE-2019-20634 is a LOW (CVSS 3.7) vulnerability affecting email protection (proofpoint).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
email protection proofpoint	`≤ 2019-09-08`	No fix yet

Description

An issue was discovered in Proofpoint Email Protection through 2019-09-08. By collecting scores from Proofpoint email headers, it is possible to build a copy-cat Machine Learning Classification model and extract insights from this model. The insights gathered allow an attacker to craft emails that receive preferable scores, with a goal of delivering malicious emails.

References

moohax/Proof-Pudding · Third Party Advisory
moohax/Talks · Third Party Advisory
proofpoint.com/us/security/CVE-2019-20634 · Vendor Advisory
proofpoint.com/us/security/security-advisories/pfpt-sn-2020-0001 · Vendor Advisory
atlas.mitre.org/studies/AML.CS0008

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free