CVE-2020-8143
- State
- Published
- Severity
- Not scored
- Published
- Apr 3, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jan 28, 2020
Description
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.
Scores
The record has no CVSS score.
Weaknesses
- CWE-601 Open Redirect (CWE-601)
Affected Products
| Product | Versions |
|---|---|
https://github.com/revive-adserver/revive-adservern/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.