CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8142
https://notcve.org/view.php?id=CVE-2020-8142
A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was however possible for anyone with access to a Revive Adserver admin user interface to bypass such check and change e-email address or password of the currently logged in user by altering the form payload.The attack requires physical access to the user interface of a logged in user. If the POST payload was altered by turning the “pwold” parameter into an array, Revive Adserver would fetch and authorise the operation even if no password was provided. Una vulnerabilidad de omisión de restricción de seguridad ha sido detectada en Revive Adserver versiones anteriores a 5.0.5, por el usuario hoangn144 de HackerOne. • https://hackerone.com/reports/792895 https://www.revive-adserver.com/security/revive-sa-2020-002 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 1CVE-2020-8115
https://notcve.org/view.php?id=CVE-2020-8115
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim. Se ha detectado una vulnerabilidad de tipo XSS reflejado en el script de entrega afr.php de acceso público de Revive Adserver versiones anteriores e incluyendo a la 5.0.3 de Jacopo Tediosi. • https://hackerone.com/reports/775693 https://www.revive-adserver.com/security/revive-sa-2020-001 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-5440
https://notcve.org/view.php?id=CVE-2019-5440
Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an attacker exploits the password recovery functionality. In lib/OA/Dal/PasswordRecovery.php, the function generateRecoveryId() generates a password reset token that relies on the PHP uniqid function and consequently depends only on the current server time, which is often visible in an HTTP Date header. El uso de PRNG (Generador de Numeros PseudoRandom) PRNG criptográficamente débil en la generación de token de recuperación de contraseña de Revive Adserver anterior a la versión 4.2.1, provoca un potencial ataque de omisión de autenticación si un atacante explota la funcionalidad de recuperación de contraseña (password recovery). • https://hackerone.com/reports/576504 • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 9.8EPSS: 28%CPEs: 1EXPL: 1CVE-2019-5434 – Revive Adserver 4.2 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-5434
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0. Un atacante podría enviar una carga específicamente creada al script de invocación XML-RPC y activar la llamada unserialize() en el parámetro "what" en el método RPC "openads.spc". • https://www.exploit-db.com/exploits/47739 http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html https://hackerone.com/reports/512076 https://hackerone.com/reports/542670 https://www.revive-adserver.com/security/revive-sa-2019-001 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-5433
https://notcve.org/view.php?id=CVE-2019-5433
A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0. Un usuario que tenga acceso a la interfaz de usuario (UI) de una instancia de Revive Adserver podría ser engañado al hacer clic sobre una URL de administrador account-switch.php específicamente creada y que eventualmente llevaría a otro dominio (no seguro), potencialmente utilizado para sustraer credenciales u otros ataques de phishing. Esta vulnerabilidad fue tratada en la versión 4.2.0. • https://hackerone.com/reports/390663 https://www.revive-adserver.com/security/revive-sa-2019-001 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •