PT-2022-6004 · Adobe · Campaign

Published 2022-12-13 · Updated 2022-12-21 · CVE-2022-42343

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Campaign versions 7.3.1 and earlier Adobe Campaign versions 8.3.9 and earlier

Description The issue is related to a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction. The vulnerability is associated with insufficient checking of incoming requests, which may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For Adobe Campaign versions 7.3.1 and earlier, update to a version later than 7.3.1 to resolve the issue. For Adobe Campaign versions 8.3.9 and earlier, update to a version later than 8.3.9 to resolve the issue. As a temporary workaround, consider restricting access to the application to minimize the risk of exploitation.

Fix

SSRF

RCE

Weakness Enumeration

CWE-918

CWE-20

Related Identifiers

BDU:2022-07455

CVE-2022-42343

Affected Products

Campaign

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-42343 · Security Note
• https://helpx.adobe.com/security/products/campaign/apsb22-58.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07455 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42343 · Vendor Advisory
• https://t.me/cibsecurity/54722 · Telegram Post
• https://t.me/cvenotify/40355 · Telegram Post