FKIE_CVE-2020-8143

Vulnerability from fkie_nvd - Published: 2020-04-03 21:15 - Updated: 2024-11-21 05:38
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.
References
support@hackerone.comhttps://hackerone.com/reports/794144Exploit, Third Party Advisory
support@hackerone.comhttps://www.revive-adserver.com/security/revive-sa-2020-002/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/794144Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.revive-adserver.com/security/revive-sa-2020-002/Vendor Advisory
Impacted products
Vendor Product Version
revive-adserver revive_adserver *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "26BF6678-398D-449B-965D-891EF3E28680",
              "versionEndExcluding": "5.0.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Open Redirect vulnerability was discovered in Revive Adserver version \u003c 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the \u201c/www/admin/*-modify.php\u201d could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the \u201creturnurl\u201d GET parameter."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 una vulnerabilidad de Redireccionamiento Abierto en Revive Adserver versi\u00f3n anteriores a 5.0.5 y reportada por el usuario hoangn144 de HackerOne. Un atacante remoto podr\u00eda enga\u00f1ar a usuarios registrados para abrir un enlace espec\u00edficamente dise\u00f1ado y redireccionarlos hacia cualquier destino. La protecci\u00f3n de CSRF en el archivo \u201c/www/admin/*-modify.php\u201d podr\u00eda ser omitida si no se env\u00eda un par\u00e1metro significativo. Ninguna acci\u00f3n se realiz\u00f3, pero el usuario a\u00fan fue redireccionado hacia la p\u00e1gina objetivo, especificada por medio del par\u00e1metro GET \"returnurl\"."
    }
  ],
  "id": "CVE-2020-8143",
  "lastModified": "2024-11-21T05:38:22.613",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-03T21:15:12.717",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/794144"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.revive-adserver.com/security/revive-sa-2020-002/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/794144"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.revive-adserver.com/security/revive-sa-2020-002/"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.