Not rated
CVE-2020-8143 An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user…
Description
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| https://github.com/revive-adserver/revive-adserver | Versions not published |
References
- hackerone.com hackerone.com
- www.revive-adserver.com www.revive-adserver.com
Timeline
- Published
- Last modified
Other CVEs of https://github.com/revive-adserver/revive-adserver
The 11 CVEs of https://github.com/revive-adserver/revive-adserver →
CVE-2021-22948
Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure…
Not rated
CVE-2021-22889
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of…
Not rated
CVE-2021-22888
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of…
Not rated
CVE-2021-22875
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter
Not rated