#VU5821 Privilege escalation in Adobe Campaign - CVE-2017-2968

Vulnerability identifier: #VU5821

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-2968

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Adobe Campaign
Server applications / Other server solutions

Vendor: Adobe

Description

The vulnerability allows a remote authenticated attacker to gain elevated privileges.

The vulnerability exists due to unknown error in Adobe Campaign. A remote authenticated user with access to the client console can obtain read and write privileges to the system.

Mitigation
Install the latest version Adobe Campaign v6.11 16.8 Build 8757.

Vulnerable software versions

Adobe Campaign: 15.9 - 16.4-8724

---

External links
https://helpx.adobe.com/security/products/campaign/apsb17-06.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.