Non évaluée
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then di...
CVE-2021-22871
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability.
Références
- advisory packetstormsecurity.com
- advisory seclists.org
- advisory revive-adserver.com
- patch github.com
- patch github.com
- report hackerone.com