CVE-2021-22873
72Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 70%
from disclosure to weapon912 days
Published on NVDJan 21
1st PoC+912d
VulnCheck+1399d
exploitation probability
70%top 1% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
Affected products
n/a · https://github.com/revive-adserver/revive-adserverpublic PoCs found — 1
vulncheckvulncheck.com/xdb/aea8fe260ba2unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.htmlhttp://seclists.org/fulldisclosure/2021/Jan/60https://github.com/revive-adserver/revive-adserver/issues/1068https://hackerone.com/reports/1081406https://www.revive-adserver.com/security/revive-sa-2021-001/