CVE-2021-21009: Server-side request forgery (SSRF) in Campaign Classic could lead to sensitive information disclosure

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-13 · updated 2026-08-24
Weakness: CWE-918

Description

Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and earlier) are affected by a server-side request forgery (SSRF) vulnerability. Successful exploitation could allow an attacker to use the Campaign instance to issue unauthorized requests to internal or external resources.

Affected products

Adobe Campaign Classic: before 19.1.8; from 19.2 before 19.2.4; from 20.1 before 20.1.4; from 20.2 before 20.2.4; from 20.3 before 20.3.3 — fixed in 19.1.8, 19.2.4, 20.1.4, 20.2.4, 20.3.3

How to fix

Upgrade to a fixed version: Adobe Campaign Classic 19.1.8, 19.2.4, 20.1.4, 20.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-21009 or the next vulnerability affects your stack