Vulnerability · Published Jan 21, 2021 · Assigned by hackerone
CVE-2021-22873
Medium 6.1
In plain English
A medium-severity open redirect in https://github.com/revive-adserver/revive-adserver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 69.6% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/revive-adserver/revive-adserver | Fixed in 5.1.0 |
Weakness: CWE-601
References
- https://hackerone.com/reports/1081406 x_refsource_MISC
- https://www.revive-adserver.com/security/revive-sa-2021-001/ x_refsource_MISC
- https://github.com/revive-adserver/revive-adserver/issues/1068 x_refsource_MISC
- 20210122 [REVIVE-SA-2021-001] Revive Adserver Vulnerabilities mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html x_refsource_MISC