Not rated
CVE-2021-22873 Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the…
Description
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| https://github.com/revive-adserver/revive-adserver | Versions not published |
References
- hackerone.com hackerone.com
- www.revive-adserver.com www.revive-adserver.com
- github.com github.com
- 20210122 [REVIVE-SA-2021-001] Revive Adserver Vulnerabilities seclists.org
- packetstormsecurity.com packetstormsecurity.com
Timeline
- Published
- Last modified
Other CVEs of https://github.com/revive-adserver/revive-adserver
The 11 CVEs of https://github.com/revive-adserver/revive-adserver →
CVE-2021-22948
Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure…
Not rated
CVE-2021-22889
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of…
Not rated
CVE-2021-22888
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of…
Not rated
CVE-2021-22875
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter
Not rated