Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Revive Adserver before 5.1.0 allows attackers to redirect users

CVE-2021-22873 · published 5 years ago
Summary

Older versions of Revive Adserver have a security flaw that could trick users into visiting fake websites. This is a concern because attackers could use it to steal sensitive information or spread malware. To fix this, update to Revive Adserver 5.1.0 or later.

What to do
  • Update revive-adserver revive_adserver to version 5.1.0 or later.
Affected software
VendorProductAffected versions
revive-adserver revive_adserver < 5.1.0
cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*
Original advisory text
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been ava...
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
70% chance of attack within 30 days
Type
CWE-601Open Redirect
Timeline
Published26 Jan 2021
Updated29 Sep 2026
First seen9 Jul 2026
Sources
CVE-2021-22873 · OSV
CVE-2021-22873 · NVD
Track software like this
Free during beta