Hi
Just a general question, according to the latest Adobe guidelines it states to avoid URL peronalization e.g. <%= url >, https://<%= url >, https://<%= domain >/path etc. Does anyone know when this came in to effect or has this always been there? The guidelines was updated in Apr 2020 but I want to understand has this always been the case or is new?.
Regards Polik
Vulnerabilities are always being discovered and the issue seems to be with a third-party library called Tidy. Apparently this library randomly doesn't patch URLs correctly which might lead to the security vulnerability (open redirect hijack / phishing).
Hard to tell if this is a new issue with no patch or its an legacy issue that was just discovered or just that Campaign uses a legacy version with the vulnerability that was eventually patched. Either way, the recommendation is not to encode hostnames in your personalised URLs.
I would say the fact that we all got an important email was this was just discovered or just exploited in the wild, but that's just speculation. The email was worded carefully "...Adobe is currently not aware of any threat actor having used this attack method in connection with your Campaign Classic instance..."
Adobe security bulletins and CVE database listings don't show anything new
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.