CVE-2020-8143: CSRF
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Frequently Asked Questions
What is CVE-2020-8143?
CVE-2020-8143 is an Open Redirect vulnerability discovered in Revive Adserver version < 5.0.5.
How does CVE-2020-8143 work?
CVE-2020-8143 allows a remote attacker to trick logged-in users into opening a specially crafted link, which redirects them to any destination of the attacker's choosing.
Which software versions are affected by CVE-2020-8143?
Revive Adserver versions prior to 5.0.5 are affected by CVE-2020-8143.
What is the severity of CVE-2020-8143?
The severity of CVE-2020-8143 is medium with a CVSS score of 6.1.
How can I fix CVE-2020-8143?
To fix CVE-2020-8143, update Revive Adserver to version 5.0.5 or higher.