Vulnerability Details : CVE-2020-8143
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.
Vulnerability category: Cross-site request forgery (CSRF)Open redirect
Products affected by CVE-2020-8143
- cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-8143
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 54 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-8143
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2020-8143
-
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.Assigned by:
- nvd@nist.gov (Primary)
- support@hackerone.com (Secondary)
References for CVE-2020-8143
-
https://hackerone.com/reports/794144
#794144 Open redirection bypass in /www/admin/campaign-modify.phpExploit;Third Party Advisory
-
https://www.revive-adserver.com/security/revive-sa-2020-002/
Revive Adserver Security Advisory SA-2020-002Vendor Advisory
Jump to