漏洞描述
Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
hackerone.comhttps://hackerone.com/reports/1081406↗github.comhttps://github.com/revive-adserver/revive-adserver/issues/1068↗seclists.orghttp://seclists.org/fulldisclosure/2021/Jan/60↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-22873↗packetstormsecurity.comhttp://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html↗