CVE-2014-8793: XSS
Cross-site scripting (XSS) vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via the refreshpage parameter to www/admin/report-generate.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8793?
CVE-2014-8793 is classified as a moderate severity cross-site scripting (XSS) vulnerability that can lead to arbitrary web script injection.
How do I fix CVE-2014-8793?
To fix CVE-2014-8793, upgrade to Revive Adserver version 3.0.6 or later.
Which versions of Revive Adserver are affected by CVE-2014-8793?
CVE-2014-8793 affects Revive Adserver versions prior to 3.0.6, specifically up to version 3.0.5.
What impact does CVE-2014-8793 have on web applications?
CVE-2014-8793 can allow remote attackers to execute arbitrary scripts in the context of a user's browser session, potentially leading to data theft.
Is there a workaround for CVE-2014-8793 if I cannot update immediately?
Currently, there is no documented workaround for CVE-2014-8793, so the recommended action is to update to a patched version.