Release date: February 14, 2017
Vulnerability identifier: APSB17-06
Priority: 3
CVE number: CVE-2017-2968, CVE-2017-2969
Platform: Windows and Linux
Adobe has released a security update for Adobe Campaign v6.11 for Windows and Linux. This update resolves a moderate security bypass affecting the Adobe Campaign client console. An authenticated user with access to the client console could upload and execute a malicious file, potentially resulting in read and write access to the system (CVE-2017-2968). This update also resolves a moderate input validation issue that could be used in cross-site scripting attacks (CVE-2017-2969).
Product | Affected version | Platform |
---|---|---|
Adobe Campaign v6.11 |
16.4 Build 8724 and earlier versions | Windows and Linux |
Adobe categorizes these updates with the following priority rating and recommends users update their installation to the newest version:
Product | Updated version | Platform | Priority rating | Availability |
---|---|---|---|---|
Adobe Campaign v6.11 | 16.8 Build 8757 and later versions |
Windows and Linux | 3 | Release Notes |
- Customers may refer to the FAQ for instructions on downloading the latest build.
- For customers with Adobe Campaign 16.4 Build 8724 and earlier, please refer to the documentation page for instructions to resolve CVE-2017-2968 by restricting uploads by file type.
- Please refer to this documentation page for assistance in upgrading Adobe Campaign server, and this documentation page for assistance in upgrading the Client Console.
- This update resolves a moderate security bypass affecting Adobe Campaign that could be exploited by an authenticated user with access to the client console. Successful exploitation could lead to read and write access to the system (CVE-2017-2968).
- This update resolves a moderate input validation issue that could be used in cross-site scripting attacks (CVE-2017-2969).