Non notée
CVE-2020-8143 An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user…
Description
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| https://github.com/revive-adserver/revive-adserver | Versions non publiées |
Références
- hackerone.com hackerone.com
- www.revive-adserver.com www.revive-adserver.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de https://github.com/revive-adserver/revive-adserver
Les 11 CVE de https://github.com/revive-adserver/revive-adserver →
CVE-2021-22948
Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure…
Non notée
CVE-2021-22889
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of…
Non notée
CVE-2021-22888
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of…
Non notée
CVE-2021-22875
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter
Non notée