CVE-2021-22873
72Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 70%
de la publicación al arma912 días
Publicada en NVD21 ene
1ª PoC+912d
VulnCheck+1399d
probabilidad de explotación
70%top 1% de las CVE
explotación observada
síVulnCheck
1 exploit(s) público(s)
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
Productos afectados
n/a · https://github.com/revive-adserver/revive-adserverPoCs públicas encontradas — 1
vulncheckvulncheck.com/xdb/aea8fe260ba2no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.htmlhttp://seclists.org/fulldisclosure/2021/Jan/60https://github.com/revive-adserver/revive-adserver/issues/1068https://hackerone.com/reports/1081406https://www.revive-adserver.com/security/revive-sa-2021-001/