CVE-2021-22873

Katalog CVE

CVSS 6.1 · Medium EPSS 69,6%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada revive-adserver revive adserver. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.

Rincian

Terbit di NVD

26 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

69,6% peluang dieksploitasi; lebih tinggi dari 99,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.revive-adserver.com/security/revive-sa-2021-001/ advisory vendor
• http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2021/Jan/60 broken link · mailing list · advisory pihak ketiga
• https://github.com/revive-adserver/revive-adserver/issues/1068 issue tracking · advisory pihak ketiga
• https://hackerone.com/reports/1081406 exploit · advisory pihak ketiga