CVE-2021-22873CWE-601

Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts

published January 21, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.

CVSS
—
EPSS
70%
Percentile
99.4
In the wild
Unconfirmed
What it is

Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.69561 · 99.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-01-21T19:14Z
EPSS history
Timeline
  • 21 JAN 19:14Z
    Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts
    cvelistv5