Description

A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0.

Remediation

References

CVE-2019-5433

Related Vulnerabilities

WordPress Plugin Store Locator Plus for WordPress Privilege Escalation (5.5.14)

Ruby on Rails Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2011-0448)

WordPress Plugin Project Supremacy V3 Lite Cross-Site Scripting (1.1)

WordPress Plugin JSM file_get_contents() Shortcode Server-Side Request Forgery (2.7.0)

IBMHttpServer Improper Input Validation Vulnerability (CVE-2023-26281)

Severity

Medium

Classification

CVE-2019-5433 CWE-601 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities