Product
Security update available for Adobe Campaign
Release date: February 14, 2017
Vulnerability identifier: APSB17-06
Priority: 3
CVE number: CVE-2017-2968, CVE-2017-2969
Platform: Windows and Linux
Summary
Adobe has released a security update for Adobe Campaign v6.11 for Windows and Linux. This update resolves a moderate security bypass affecting the Adobe Campaign client console. An authenticated user with access to the client console could upload and execute a malicious file, potentially resulting in read and write access to the system (CVE-2017-2968). This update also resolves a moderate input validation issue that could be used in cross-site scripting attacks (CVE-2017-2969).
Affected versions
|
Affected version |
Platform |
Adobe Campaign v6.11 |
16.4 Build 8724 and earlier versions |
Windows and Linux |
Solution
Adobe categorizes these updates with the following priority rating and recommends users update their installation to the newest version:
Product |
Updated version |
Platform |
Priority rating |
Availability |
Adobe Campaign v6.11 |
16.8 Build 8757 and later versions |
Windows and Linux |
3 |
- Customers may refer to the FAQ for instructions on downloading the latest build.
- For customers with Adobe Campaign 16.4 Build 8724 and earlier, please refer to the documentation page for instructions to resolve CVE-2017-2968 by restricting uploads by file type.
- Please refer to this documentation page for assistance in upgrading Adobe Campaign server, and this documentation page for assistance in upgrading the Client Console.
Vulnerability Details
- This update resolves a moderate security bypass affecting Adobe Campaign that could be exploited by an authenticated user with access to the client console. Successful exploitation could lead to read and write access to the system (CVE-2017-2968).
- This update resolves a moderate input validation issue that could be used in cross-site scripting attacks (CVE-2017-2969).
Acknowledgments
Adobe would like to thank Léa NUEL of NES for reporting these issues (CVE-2017-2968 and CVE-2017-2969) and for working with Adobe to help protect our customers.