SB2017021403 - Two vulnerabilities in Adobe Campaign
Published: February 14, 2017
Security Bulletin ID
SB2017021403
Severity
Medium
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2017-2969)
The vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to insufficient input validation. A remote attacker can launch a cross-site scripting attack against users of vulnerable application.2) Privilege escalation (CVE-ID: CVE-2017-2968)
The vulnerability allows a remote authenticated attacker to gain elevated privileges.
The vulnerability exists due to unknown error in Adobe Campaign. A remote authenticated user with access to the client console can obtain read and write privileges to the system.
Remediation
Install update from vendor's website.