CVE-2021-22873: Medium severity revive adserver vulnerability
Revive Adserver before 5.1.0 is vulnerable to open redirects via the dest, oadest, and/or ct0 parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-22873?
CVE-2021-22873 refers to a vulnerability in Revive Adserver before 5.1.0 that allows open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts.
How does CVE-2021-22873 affect Revive Adserver?
CVE-2021-22873 affects Revive Adserver versions before 5.1.0 by enabling open redirects through specific parameters in the delivery scripts.
What is the severity of CVE-2021-22873?
CVE-2021-22873 has a severity rating of 6.1, which is considered medium.
How can I fix CVE-2021-22873?
To fix CVE-2021-22873, you should update your Revive Adserver installation to version 5.1.0 or newer.
Where can I find more information about CVE-2021-22873?
You can find more information about CVE-2021-22873 on the following references: [Link 1](http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html), [Link 2](http://seclists.org/fulldisclosure/2021/Jan/60), [Link 3](https://github.com/revive-adserver/revive-adserver/issues/1068)