Non notée

CVE-2021-22871 Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL…

Description

Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
https://github.com/revive-adserver/revive-adserver	Versions non publiées

Références

www.revive-adserver.com www.revive-adserver.com
hackerone.com hackerone.com
github.com github.com
github.com github.com
20210122 [REVIVE-SA-2021-001] Revive Adserver Vulnerabilities seclists.org
packetstormsecurity.com packetstormsecurity.com

Chronologie

Publiée 21 janvier 2021
Dernière modification 3 août 2024

Les 11 CVE de https://github.com/revive-adserver/revive-adserver →

CVE-2021-22948 Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure… Non notée CVE-2021-22889 Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of… Non notée CVE-2021-22888 Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of… Non notée CVE-2021-22875 Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter Non notée

Suivre cette CVE