CVE-2021-22872CWE-79

Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script

published January 21, 2021

CVSS
—
EPSS
3%
Percentile
89.1
In the wild
Unconfirmed
What it is

Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03489 · 89.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-01-21T19:15Z
EPSS history
Timeline
  • 21 JAN 19:15Z
    Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script
    cvelistv5