Title: Over 20 Configuration Vulnerabilities Discovered in Salesforce Industry Cloud, Including Five CVEs

Date: June 10, 2025
Category: Vulnerability / SaaS Security

Cybersecurity experts have identified more than 20 configuration vulnerabilities within Salesforce Industry Cloud (formerly known as Salesforce Industries), potentially exposing sensitive data to unauthorized users. These vulnerabilities impact key components such as FlexCards, Data Mappers, Integration Procedures (IProcs), Data Packs, OmniOut, and OmniScript Saved Sessions. “While low-code platforms like Salesforce Industry Cloud simplify application development, neglecting security measures can lead to significant risks,” said Aaron Costello, Chief of SaaS Security Research at AppOmni, in a statement to The Hacker News. If not mitigated, these misconfigurations may enable cybercriminals and unauthorized individuals to access encrypted sensitive information about employees and customers, session data reflecting user interactions with Salesforce Industry Cloud, credentials for Salesforce and other corporate systems, and critical business logic. Following a responsible disclosure process, more information is anticipated.

Cybersecurity Researchers Identify Over 20 Configuration Vulnerabilities in Salesforce Industry Cloud

June 10, 2025

Recent investigations by cybersecurity experts have revealed more than 20 configuration vulnerabilities within Salesforce Industry Cloud, also known as Salesforce Industries. These security weaknesses pose significant risks, as they could potentially expose sensitive data to unauthorized internal and external entities. The vulnerabilities affect a variety of components including FlexCards, Data Mappers, Integration Procedures (IProcs), Data Packs, OmniOut, and OmniScript Saved Sessions.

Aaron Costello, the chief of SaaS Security Research at AppOmni, highlighted the trade-offs involved with low-code platforms such as Salesforce Industry Cloud. While these tools simplify application development, they can inadvertently create security gaps if robust security measures are not prioritized. Left unaddressed, these misconfigurations may enable cybercriminals and other unauthorized individuals to gain access to encrypted confidential information pertaining to employees and customers alike, session data reflecting user interactions within the platform, as well as credentials for Salesforce and other corporate systems.

The research reveals that the vulnerabilities stem from improper configurations, which could facilitate unauthorized access to business logic and confidential data. Such security oversights not only compromise the data integrity of organizations but also their operational security. Industry experts caution that the implications of these vulnerabilities could be severe, leading to data breaches that might ultimately impact customer trust and the reputation of organizations utilizing this platform.

As the digital landscape evolves, the importance of a proactive security approach is paramount. Organizations leveraging Salesforce Industry Cloud must ensure that configurations are thoroughly vetted and secured. These weaknesses also align with tactics outlined in the MITRE ATT&CK Matrix, specifically reflecting concerns in initial access and potential privilege escalation. By understanding and implementing mitigations against these tactics, businesses can enhance their cybersecurity posture and reduce the risk of exploitation.

Salesforce Industry Cloud serves as a cornerstone for numerous businesses seeking to streamline operations, but it is crucial that organizations adopting such technologies remain vigilant. The findings emphasize the need for ongoing security assessments and the implementation of best practices to safeguard sensitive data. Companies are urged to take immediate action to review their configurations, ensuring compliance with security protocols to protect against potential threats.

As cybersecurity threats continue to evolve, understanding the landscape of vulnerabilities will be essential for any business relying on SaaS solutions. Awareness, continuous monitoring, and adopting a defensive strategy can help mitigate risks, protecting both organizational and customer data from the ever-growing array of cyber threats.

Source link

Related Posts

China-Linked Cyber Espionage Group Targets Over 70 Organizations Across Diverse Sectors

June 9, 2025
Government Security / Cyber Espionage

Recent reconnaissance efforts against American cybersecurity firm SentinelOne are part of a larger wave of intrusions affecting various targets between July 2024 and March 2025. “The victims include a South Asian government agency, a European media outlet, and over 70 organizations spanning numerous sectors,” noted SentinelOne security researchers Aleksandar Milenkoski and Tom Hegel in a recent report. Affected sectors include manufacturing, government, finance, telecommunications, and research. Notably, an IT services and logistics firm was compromised while managing equipment logistics for SentinelOne staff during the breach in early 2025. This malicious activity has been confidently linked to threat actors associated with China, with some attacks attributed to a cluster known as PurpleHaze, which overlaps with recognized Chinese cyber espionage groups labeled APT15.

CISA Includes Erlang SSH and Roundcube Vulnerabilities in Known Exploited Threats Catalog

On June 10, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two significant security vulnerabilities affecting Erlang/Open Telecom Platform (OTP) SSH and Roundcube to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The identified vulnerabilities are:

  • CVE-2025-32433 (CVSS score: 10.0): A critical missing authentication flaw in the Erlang/OTP SSH server that could enable an attacker to execute arbitrary commands without proper credentials, potentially leading to unauthenticated remote code execution. (Patched in April 2025 in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20)

  • CVE-2024-42009 (CVSS score: 9.3): A cross-site scripting (XSS) vulnerability in RoundCube Webmail that may allow a remote attacker to compromise a victim’s email account by exploiting a desanitization flaw in program/actions/mail/show.php. (Fixed in August 2024 in versions 1.6…)

Researcher Uncovers Vulnerability Exposing Phone Numbers Linked to Google Accounts

Jun 10, 2025
Vulnerability / API Security

Google has acted to resolve a security flaw that could allow malicious actors to brute-force recovery phone numbers associated with Google accounts, potentially compromising user privacy and security. Singaporean security researcher “brutecat” identified that the vulnerability exploited a weakness in the company’s account recovery feature. The issue involved a now-obsolete version of the Google username recovery form (“accounts.google[.]com/signin/usernamerecovery”) that lacked sufficient anti-abuse measures to limit excessive requests. This page allows users to check if a recovery email or phone number is linked to a specific display name (e.g., “John Smith”). By bypassing the CAPTCHA rate limits, attackers could rapidly test various permutations of a Google account’s phone number, leading to possible exploitation.

Microsoft Addresses 67 Vulnerabilities, Including Active WEBDAV Zero-Day Exploit

On June 11, 2025, Microsoft unveiled patches for 67 security vulnerabilities, among which is a zero-day flaw in Web Distributed Authoring and Versioning (WebDAV) that has been actively exploited. Of these vulnerabilities, 11 are classified as Critical, while 56 are deemed Important. The update addresses 26 remote code execution issues, 17 information disclosure vulnerabilities, and 14 privilege escalation risks. Additionally, the patches follow the resolution of 13 vulnerabilities in the Chromium-based Edge browser since last month’s Patch Tuesday. The zero-day exploit, designated CVE-2025-33053 (CVSS score: 8.8), allows remote code execution through deceptive URLs. Microsoft credited Check Point researchers Alexandra Gofman and David Driker for identifying and reporting this critical vulnerability. Notably, CVE-2025-33053 marks the first zero-day vulnerability…