CVE-2022-42343 - OpenCVE

Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Linux	Linux Kernel
Microsoft	Windows
Adobe	Campaign

Configuration 1 [-]

AND

OR	cpe:2.3:a:adobe:campaign:::::classic:::*
	cpe:2.3:a:adobe:campaign:::::classic:::*

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

References

Link	Resource
https://helpx.adobe.com/security/products/campaign/apsb22-58.html	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: adobe

Published: 2022-12-13T00:00:00

Updated: 2022-12-16T00:00:00

Reserved: 2022-10-03T00:00:00

Link: CVE-2022-42343

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-12-16T16:15:22.197

Modified: 2022-12-21T17:48:47.057

Link: CVE-2022-42343

JSON object: View

Redhat Information

No data.

CWE

CWE-918

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*", "matchCriteriaId": "71158D04-22A1-4799-970E-F991A0B22FB6", "versionEndExcluding": "7.3.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*", "matchCriteriaId": "6B27864A-0B03-4519-AA1F-F50642205E9E", "versionEndExcluding": "8.4.2", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction."}, {"lang": "es", "value": "Adobe Campaign versi\u00f3n 7.3.1 (y anteriores) y 8.3.9 (y anteriores) se ven afectados por una vulnerabilidad de Server-Side Request Forgery (SSRF) que podr\u00eda provocar una lectura arbitraria del sistema de archivos. Un atacante autenticado con pocos privilegios puede obligar a la aplicaci\u00f3n a realizar solicitudes arbitrarias mediante la inyecci\u00f3n de URL arbitrarias. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."}], "id": "CVE-2022-42343", "lastModified": "2022-12-21T17:48:47.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@adobe.com", "type": "Primary"}]}, "published": "2022-12-16T16:15:22.197", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/campaign/apsb22-58.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "psirt@adobe.com", "type": "Primary"}]}