CVE-2021-22889
Medium
Description
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code.
SeverityMedium
CVSS6.1
Exploit probability98. percentile30.5%
ProductRevive-adserver Revive Adserver
PublishedMar 25, 2021
First seenMar 25, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- revive-adserver revive_adserver5.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| revive-adserver revive_adserver | v < 5.2.0 | 5.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.