Stored XSS in Revive Adserver Maintenance Tools

Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue found in the maintenance-acl-check.php and maintenance-banners-check.php tools of Revive Adserver version 6.0.7.

It occurs because entity names are displayed without proper escaping when inconsistencies are detected, allowing malicious scripts to be stored and potentially executed.

However, whether the malicious script (XSS payload) is executed depends on the administrator using the affected maintenance tools, and this execution is not fully under the attacker's control.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to inject malicious scripts that may execute in the context of an administrator using the affected maintenance tools.

Such execution could lead to limited confidentiality and integrity impacts, as indicated by the CVSS score, potentially allowing attackers to perform actions with some privileges or access sensitive information.

However, the attack requires the administrator to interact with the affected tools, and the attack complexity is high with low privileges and required user interaction.

Useful 0 Not Useful 0