CVE-2021-22873
72Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 70%
da publicação à arma912 dias
Publicada no NVD21 de jan.
1ª PoC+912d
VulnCheck+1399d
probabilidade de exploração
70%top 1% das CVEs
exploração observada
simVulnCheck
1 exploit(s) público(s)
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
Produtos afetados
n/a · https://github.com/revive-adserver/revive-adserverPoCs públicas encontradas — 1
vulncheckvulncheck.com/xdb/aea8fe260ba2não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.htmlhttp://seclists.org/fulldisclosure/2021/Jan/60https://github.com/revive-adserver/revive-adserver/issues/1068https://hackerone.com/reports/1081406https://www.revive-adserver.com/security/revive-sa-2021-001/