CVE-2021-22872
MEDIUM 6.1EPSS 3.5%
Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable.
- Affected
- https://github.com/revive-adserver/revive-adserver
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 3.49% chance of exploitation in the next 30 days, 89th percentile
- Published
- 2021-01-21
- Updated
- 2024-08-03
Proof-of-concept exploits (1)
Security advisories
- https://www.revive-adserver.com/security/revive-sa-2021-001
- http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Op…
- http://seclists.org/fulldisclosure/2021/Jan/60
- revive-adserver/revive-adserver/commit/00fdb8d0e