Non notée

CVE-2021-22873 Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the…

Description

Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
https://github.com/revive-adserver/revive-adserver	Versions non publiées

Références

hackerone.com hackerone.com
www.revive-adserver.com www.revive-adserver.com
github.com github.com
20210122 [REVIVE-SA-2021-001] Revive Adserver Vulnerabilities seclists.org
packetstormsecurity.com packetstormsecurity.com

Chronologie

Publiée 21 janvier 2021
Dernière modification 3 août 2024

Les 11 CVE de https://github.com/revive-adserver/revive-adserver →

CVE-2021-22948 Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure… Non notée CVE-2021-22889 Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of… Non notée CVE-2021-22888 Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of… Non notée CVE-2021-22875 Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter Non notée

Suivre cette CVE