CVE-2020-8143 | BDVDB-2026-133449 Detail

https://github.com/revive-adserver/revive-adserver

Description#

An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-601 Open Redirect (CWE-601)

References#

https://hackerone.com/reports/794144
https://www.revive-adserver.com/security/revive-sa-2020-002/

Exploit#

No public exploit known

History#

Version 12020-04-03Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.