Adobe has released patches for eight critical security flaws in Adobe Campaign Classic, its marketing campaign software, after warning that successful exploitation could lead to arbitrary code execution, a security-feature bypass or privilege escalation. The flaws affect Campaign Classic version 7.4.4 build 9402 and earlier on Windows and Linux, and are fixed in version 7.4.4 build 9403. Adobe published the update on 27 October, and the fixes were reported on 28 October.

Code injection and SQL flaws

The most serious flaws, each rated 9.9, include a code injection flaw, an operating-system command injection flaw, an incorrect authorisation flaw and an SQL injection flaw. A further SQL injection flaw was rated 9.8, while a reflected cross-site scripting flaw was rated 9.3 and two more SQL injection flaws were rated 9.1. Adobe also fixed a critical code injection flaw in Adobe Connect, rated 9.6, affecting desktop and mobile versions on Windows, macOS and Android.

No exploitation reported

Adobe said it was not aware of any exploits in the wild for the Campaign Classic flaws at the time of publication, so no exploitation has been reported. Even so, administrators are advised to apply the update promptly, because the flaws are network-reachable and some require only low privileges. Organisations running older or unsupported versions should check Adobe's bulletin for their fixed build and confirm the patched version is actually in use.

Sources: The Hacker News, SecurityOnline.