Risk | High |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-2989 |
CWE-ID | CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Adobe Campaign Server applications / Other server solutions |
Vendor | Adobe |
Security Bulletin
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU6194
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-2989
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to read, write or delete data on the target system.
The weakness exists due to improper input validation. A remote attacker can create a specially crafted file, trick the victim into opening it and read, write or delete data from the Campaign database.
Successful exploitation of the vulnerability results in compromise vulnerable system.
Update to version 6.11 Build 8795.
Vulnerable software versionsAdobe Campaign: 6.11-8770 - 16.8-8757
External linkshttp://helpx.adobe.com/security/products/campaign/apsb17-09.html
http://helpx.adobe.com/campaign/kb/security-update-CVE-2017-2989.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.