CVE-2026-108558: XSS
A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 6.0.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated users who can be persuaded to open a crafted URL to the conversion-statistics pages are exposed to JavaScript execution in their browser. The attacker does not need authentication, but exploitation requires user interaction.
Which deployments are affected?
Revive Adserver 6.0.8 and earlier are affected. The issue is fixed in version 6.0.9.
What enables exploitation?
An incorrect ownership check validates an advertiser identifier rather than the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output-handling issue also affects the hour parameter.
What should be done if immediate patching is not possible?
The provided information identifies version 6.0.9 as the fix, but does not specify a workaround. Until upgrading, treat links to conversion-statistics pages as untrusted and avoid opening crafted or unsolicited URLs while authenticated.