What’s Vulnerable › Vulnerabilities

CVE-2020-8143

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 70.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-04-03 · updated 2026-06-17
• Weakness: CWE-601

Description

An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter.

Affected products

• Revive Adserver: before 5.0.5 — fixed in 5.0.5

How to fix

Upgrade to a fixed version: Revive Adserver 5.0.5. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/794144
• https://www.revive-adserver.com/security/revive-sa-2020-002/
• https://hackerone.com/reports/794144
• https://www.revive-adserver.com/security/revive-sa-2020-002/

Get alerted when CVE-2020-8143 or the next vulnerability affects your stack