CVE-2022-42343
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
Risk Assessment
An attacker can read arbitrary files from the system, potentially leading to disclosure of sensitive data such as configurations, user data, or keys.
Recommendation
It is recommended to immediately upgrade Adobe Campaign to a version that includes the fix. Also restrict user privileges and monitor outbound requests.
Original NVD description (English source)
Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.