未評価
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then di...
CVE-2021-22871
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability.
参照URL
- advisory packetstormsecurity.com
- advisory seclists.org
- advisory revive-adserver.com
- patch github.com
- patch github.com
- report hackerone.com