CVE-2021-22873
First published: Thu Jan 21 2021(Updated: )
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Revive-adserver Revive Adserver | <5.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html
- http://seclists.org/fulldisclosure/2021/Jan/60
- https://github.com/revive-adserver/revive-adserver/issues/1068
- https://hackerone.com/reports/1081406
- https://www.revive-adserver.com/security/revive-sa-2021-001/
Frequently Asked Questions
What is CVE-2021-22873?
CVE-2021-22873 refers to a vulnerability in Revive Adserver before 5.1.0 that allows open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts.
How does CVE-2021-22873 affect Revive Adserver?
CVE-2021-22873 affects Revive Adserver versions before 5.1.0 by enabling open redirects through specific parameters in the delivery scripts.
What is the severity of CVE-2021-22873?
CVE-2021-22873 has a severity rating of 6.1, which is considered medium.
How can I fix CVE-2021-22873?
To fix CVE-2021-22873, you should update your Revive Adserver installation to version 5.1.0 or newer.
Where can I find more information about CVE-2021-22873?
You can find more information about CVE-2021-22873 on the following references: [Link 1](http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html), [Link 2](http://seclists.org/fulldisclosure/2021/Jan/60), [Link 3](https://github.com/revive-adserver/revive-adserver/issues/1068)
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/revive-adserver
- canonical/revive-adserver revive adserver