Inactive Salesforce Communities could leak sensitive data

Threat actors could gain access to improperly deactivated or unmaintained Salesforce sites by changing the host header, thereby gaining access to sensitive personal and business data.

In a Wednesday blog post by Varonis Threat Labs, researcher Nitay Bachrach wrote so-called “ghost sites” are Salesforce communities that are no longer being used. The abandoned sites were originally designed to allow partners and customers to collaborate within a company’s Salesforce environment. Ghost sites are simply forgotten or unused collaborative sites that instead of being deactivated create a liability, researchers said.

https://www.scmagazine.com/news/cloud-security/inactive-salesforce-sensitive-data