2 lines
1.7 KiB
JSON
2 lines
1.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting."}],"id":"CVE-2026-108558","lastModified":"2026-11-11T18:18:26.227","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.227","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3878649"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]}
|