Vulnerability · Published Jan 13, 2021 · Assigned by adobe

CVE-2021-21009Server-side request forgery (SSRF) in Campaign Classic could lead to sensitive information disclosure

High 8.6

In plain English

A high-severity server-side request forgery in Campaign from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)3.1%top 12.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and earlier) are affected by a server-side request forgery (SSRF) vulnerability. Successful exploitation could allow an attacker to use the Campaign instance to issue unauthorized requests to internal or external resources.

Affected products (as reported)

Vendor	Product	Versions
Adobe	Campaign	unspecified – through 20.3.1 and earlierunspecified – through Gold Standard 10 and earlierunspecified – through 20.2.3 and earlierunspecified – through 20.1.3 and earlierunspecified – through 19.2.3 and earlierunspecified – through 19.1.7 and earlier

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://helpx.adobe.com/security/products/campaign/apsb21-04.html x_refsource_MISC