Описание
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
Ссылки
- PatchThird Party Advisory
- Issue TrackingPatchThird Party Advisory
- Permissions Required
- PatchVendor Advisory
- PatchThird Party Advisory
- Issue TrackingPatchThird Party Advisory
- Permissions Required
- PatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.2.2 (включая)
cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*
EPSS
Процентиль: 58%
0.00373
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79
CWE-79
Связанные уязвимости
CVSS3: 5.4
github
больше 3 лет назад
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
EPSS
Процентиль: 58%
0.00373
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79
CWE-79