CVE-2022-42343CWE-918ssrf

CVE-2022-42343

Medium · published December 16, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
73.5
In the wild
Unconfirmed
What it is

Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01466 · 73.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2022-12-16T21:15Z
Affected products (2)
ProductVersionsFixed in
adobe/campaign< 7.3.27.3.2
adobe/campaign≥ 8.0.0, < 8.4.28.4.2
References (2)
https://helpx.adobe.com/security/products/campaign/apsb22-58.html · [email protected]https://helpx.adobe.com/security/products/campaign/apsb22-58.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 19 DEC 10:00Z
    Adobe Campaign Classic Server-Side Request Forgery Arbitrary file system read
    cvelistv5