PT-2019-17665 · Revive Adserver · Revive Adserver

Sumni · Published 2019-05-06 · Updated 2019-10-09 · CVE-2019-5433

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 4.2.0

Description A phishing attack could be conducted by tricking a user into clicking a specifically crafted admin account-switch.php URL, potentially leading to credential theft or other phishing attacks.

Recommendations For versions prior to 4.2.0, update to version 4.2.0 to resolve the issue. As a temporary workaround, consider restricting access to the account-switch.php page until the update is applied. Avoid clicking on suspicious URLs, especially those that may redirect to unsafe domains.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2019-5433

Affected Products

Revive Adserver

References · 4

• 🔥 https://hackerone.com/reports/390663 · Exploit
• https://revive-adserver.com/security/revive-sa-2019-001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5433 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5433 · Security Note