CVE-2021-21009CWE-918ssrf

CVE-2021-21009

High · published January 14, 2021

CVSS v3.1
8.6
EPSS
3%
Percentile
87.5
In the wild
Unconfirmed
What it is

Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and earlier) are affected by a server-side request forgery (SSRF) vulnerability. Successful exploitation could allow an attacker to use the Campaign instance to issue unauthorized requests to internal or external resources.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03051 · 87.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2021-01-14T04:15Z
Affected products (5)
ProductVersionsFixed in
adobe/campaign< 19.1.819.1.8
adobe/campaign≥ 19.2, < 19.2.419.2.4
adobe/campaign≥ 20.1, < 20.1.420.1.4
adobe/campaign≥ 20.2, < 20.2.420.2.4
adobe/campaign≥ 20.3, < 20.3.320.3.3
References (2)
https://helpx.adobe.com/security/products/campaign/apsb21-04.html · [email protected]https://helpx.adobe.com/security/products/campaign/apsb21-04.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 13 JAN 22:47Z
    Server-side request forgery (SSRF) in Campaign Classic could lead to sensitive information disclosure
    cvelistv5