{"containers": {"cna": {"affected": [{"product": "https://github.com/revive-adserver/revive-adserver", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in >= 5.0.5"}]}], "descriptions": [{"lang": "en", "value": "An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the \u201c/www/admin/*-modify.php\u201d could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the \u201creturnurl\u201d GET parameter."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "Open Redirect (CWE-601)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-04-03T20:52:41", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/794144"}, {"tags": ["x_refsource_MISC"], "url": "https://www.revive-adserver.com/security/revive-sa-2020-002/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2020-8143", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "https://github.com/revive-adserver/revive-adserver", "version": {"version_data": [{"version_value": "Fixed in >= 5.0.5"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the \u201c/www/admin/*-modify.php\u201d could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the \u201creturnurl\u201d GET parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Open Redirect (CWE-601)"}]}]}, "references": {"reference_data": [{"name": "https://hackerone.com/reports/794144", "refsource": "MISC", "url": "https://hackerone.com/reports/794144"}, {"name": "https://www.revive-adserver.com/security/revive-sa-2020-002/", "refsource": "MISC", "url": "https://www.revive-adserver.com/security/revive-sa-2020-002/"}]}}}}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2020-8143", "datePublished": "2020-04-03T20:52:41", "dateReserved": "2020-01-28T00:00:00", "dateUpdated": "2020-04-03T20:52:41", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "26BF6678-398D-449B-965D-891EF3E28680", "versionEndExcluding": "5.0.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the \u201c/www/admin/*-modify.php\u201d could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the \u201creturnurl\u201d GET parameter."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad de Redireccionamiento Abierto en Revive Adserver versi\u00f3n anteriores a 5.0.5 y reportada por el usuario hoangn144 de HackerOne. Un atacante remoto podr\u00eda enga\u00f1ar a usuarios registrados para abrir un enlace espec\u00edficamente dise\u00f1ado y redireccionarlos hacia cualquier destino. La protecci\u00f3n de CSRF en el archivo \u201c/www/admin/*-modify.php\u201d podr\u00eda ser omitida si no se env\u00eda un par\u00e1metro significativo. Ninguna acci\u00f3n se realiz\u00f3, pero el usuario a\u00fan fue redireccionado hacia la p\u00e1gina objetivo, especificada por medio del par\u00e1metro GET \"returnurl\"."}], "id": "CVE-2020-8143", "lastModified": "2020-04-06T13:49:55.720", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-04-03T21:15:12.717", "references": [{"source": "support@hackerone.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://hackerone.com/reports/794144"}, {"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://www.revive-adserver.com/security/revive-sa-2020-002/"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-601"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{}