{"containers": {"cna": {"affected": [{"product": "https://github.com/revive-adserver/revive-adserver", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in 5.1.0"}]}], "descriptions": [{"lang": "en", "value": "Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Cross-site Scripting (XSS) - Stored (CWE-79)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-25T16:06:19", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.revive-adserver.com/security/revive-sa-2021-001/"}, {"tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/819362"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/revive-adserver/revive-adserver/commit/89b88ce26"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/revive-adserver/revive-adserver/commit/62a2a0439"}, {"name": "20210122 [REVIVE-SA-2021-001] Revive Adserver Vulnerabilities", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2021/Jan/60"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2021-22871", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "https://github.com/revive-adserver/revive-adserver", "version": {"version_data": [{"version_value": "Fixed in 5.1.0"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross-site Scripting (XSS) - Stored (CWE-79)"}]}]}, "references": {"reference_data": [{"name": "https://www.revive-adserver.com/security/revive-sa-2021-001/", "refsource": "MISC", "url": "https://www.revive-adserver.com/security/revive-sa-2021-001/"}, {"name": "https://hackerone.com/reports/819362", "refsource": "MISC", "url": "https://hackerone.com/reports/819362"}, {"name": "https://github.com/revive-adserver/revive-adserver/commit/89b88ce26", "refsource": "MISC", "url": "https://github.com/revive-adserver/revive-adserver/commit/89b88ce26"}, {"name": "https://github.com/revive-adserver/revive-adserver/commit/62a2a0439", "refsource": "MISC", "url": "https://github.com/revive-adserver/revive-adserver/commit/62a2a0439"}, {"name": "20210122 [REVIVE-SA-2021-001] Revive Adserver Vulnerabilities", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2021/Jan/60"}, {"name": "http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html"}]}}}}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2021-22871", "datePublished": "2021-01-21T19:15:11", "dateReserved": "2021-01-06T00:00:00", "dateUpdated": "2021-01-25T16:06:19", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA528298-DAAD-4C82-A08C-9F916F5A86BF", "versionEndExcluding": "5.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability."}, {"lang": "es", "value": "Revive Adserver versiones anteriores a 5.1.0, permite a cualquier usuario con una cuenta de administrador almacenar contenido posiblemente malicioso en la propiedad del sitio web URL, que luego es mostrada sin saneamiento en la pantalla de generaci\u00f3n de etiquetas affiliate-preview.php, conllevando a una vulnerabilidad de tipo cross-site scripting (XSS ) persistente"}], "id": "CVE-2021-22871", "lastModified": "2021-02-01T18:23:47.440", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-01-26T18:16:19.020", "references": [{"source": "support@hackerone.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html"}, {"source": "support@hackerone.com", "tags": ["Broken Link", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2021/Jan/60"}, {"source": "support@hackerone.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/revive-adserver/revive-adserver/commit/62a2a0439"}, {"source": "support@hackerone.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/revive-adserver/revive-adserver/commit/89b88ce26"}, {"source": "support@hackerone.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://hackerone.com/reports/819362"}, {"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://www.revive-adserver.com/security/revive-sa-2021-001/"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{}