exploitDog

CVE-2025-48986

Опубликовано: 20 нояб. 2025

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

Ссылки

https://hackerone.com/reports/3398283
Exploit
Issue Tracking
Third Party Advisory
https://hackerone.com/reports/3398283
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*

Версия до 5.5.2 (включая)

cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.1 (включая)

EPSS

Процентиль: 5%

0.00021

Низкий

8.8 High

CVSS3

Дефекты

CWE-284

Связанные уязвимости

GHSA-5pqq-jrvh-h276

CVSS3: 8.8

github

3 месяца назад

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

EPSS

Процентиль: 5%

0.00021

Низкий

8.8 High

CVSS3

Дефекты

CWE-284