Organizations allowing guest access to websites they created with Salesforce Community are misconfiguring the capability, letting unauthenticated users see and copy a wider amount of data than visitors should be entitled to.<\/p>\n
That’s according to security reporter Brian Krebs, who in an article last week<\/a> said a wide range of American organizations, including banks and healthcare providers, are leaking private and sensitive information from their public Salesforce Community sites.<\/p>\n The guest access capability allows unauthenticated users to view specific content and resources without needing to log in, he wrote. However, sometimes Salesforce administrators mistakenly grant guest users access to internal resources, which can cause unauthorized users to access an organization\u2019s private information and leads to potential data leaks.<\/p>\n For example, Krebs wrote, the state of\u00a0Vermont\u00a0had at least five separate Salesforce Community sites that allowed guest access to sensitive data, including a Pandemic Unemployment Assistance program that exposed the applicant\u2019s full name, Social Security number, address, phone number, email, and bank account number.<\/p>\n The state’s CISO told Krebs the vulnerable sites were all created rapidly in response to the Coronavirus pandemic, and were not subjected to their normal security review process.<\/p>\n Krebs was tipped off by security researcher Charan Akiri about the problem. But Krebs also notes that\u00a0security researcher\u00a0Aaron Costello has been blogging about it since August, 2021, including this column on how to plug the hole.<\/a><\/p>\n The article notes Salesforce says the data exposures are not the result of a vulnerability in its platform, but occur when customers\u2019 access control permissions are misconfigured.<\/p>\n \u201cAs previously communicated to all Experience Site and Sites customers, we recommend utilizing the\u00a0Guest User Access Report Package<\/a>\u00a0to assist in reviewing access control permissions for unauthenticated users,\u201d reads a Salesforce\u00a0advisory from Sept. 2022<\/a>. \u201cAdditionally, we suggest reviewing the following\u00a0Help article, Best Practices and Considerations When Configuring the Guest User Profile<\/a>.\u201d<\/p>\n The post Firms warned against misconfiguring guest access to Salesforce Community<\/a> first appeared on IT World Canada<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Guest access can give unauthorized visitors the ability to see and copy all corp<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[361,16],"tags":[262,393,275],"class_list":["post-37965","post","type-post","status-publish","format-standard","hentry","category-privacy","category-security","tag-salesforce","tag-security-strategies","tag-top-story"],"acf":[],"_links":{"self":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/37965","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/comments?post=37965"}],"version-history":[{"count":2,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/37965\/revisions"}],"predecessor-version":[{"id":38031,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/37965\/revisions\/38031"}],"wp:attachment":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/media?parent=37965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/categories?post=37965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/tags?post=37965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}