CVE-2019-20634

3.7 lowEPSS 1.6%

Low (3.7) in proofpoint email protection. EPSS 1.6% chance of exploitation in the next 30 days.

An issue was discovered in Proofpoint Email Protection through 2019-09-08. By collecting scores from Proofpoint email headers, it is possible to build a copy-cat Machine Learning Classification model and extract insights from this model. The insights gathered allow an attacker to craft emails that receive preferable scores, with a goal of delivering malicious emails.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-697
Published: 2020-03-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

proofpoint:email_protection

References

https://github.com/moohax/Proof-Pudding
https://github.com/moohax/Talks/blob/master/slides/DerbyCon19.pdf
https://www.proofpoint.com/us/security/CVE-2019-20634
https://www.proofpoint.com/us/security/security-advisories/pfpt-sn-2020-0001
https://atlas.mitre.org/studies/AML.CS0008

Check your stack JSON