URL Personalization Guideline Query

polik335

21-04-2020

Hi

 

Just a general question, according to the latest Adobe guidelines it states to avoid URL peronalization e.g. <%= url >, https://<%= url >, https://<%= domain >/path etc. Does anyone know when this came in to effect or has this always been there? The guidelines was updated in Apr 2020 but I want to understand has this always been the case or is new?.

 

Regards Polik

Adobe Campaign Classic domain personlization URL

Accepted Solutions (1)

Accepted Solutions (1)

DarrenOrigin

21-04-2020

Vulnerabilities are always being discovered and the issue seems to be with a third-party library called Tidy. Apparently this library randomly doesn't patch URLs correctly which might lead to the security vulnerability (open redirect hijack / phishing).

Hard to tell if this is a new issue with no patch or its an legacy issue that was just discovered or just that Campaign uses a legacy version with the vulnerability that was eventually patched. Either way, the recommendation is not to encode hostnames in your personalised URLs.

I would say the fact that we all got an important email was this was just discovered or just exploited in the wild, but that's just speculation. The email was worded carefully "...Adobe is currently not aware of any threat actor having used this attack method in connection with your Campaign Classic instance..."

Adobe security bulletins and CVE database listings don't show anything new

 

Answers (0)