2 lines
1.8 KiB
JSON
2 lines
1.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations."}],"id":"CVE-2026-68486","lastModified":"2026-11-11T18:19:48.960","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:19:48.960","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3958112"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"support@hackerone.com","type":"Secondary"}]}
|