CVE-2023-38040

MEDIUMNuclei

Revive Adserver 5.4.1 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-38040 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 25, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Revive Adserver

Browse Revive / Revive Adserver

Default status: unaffected

CVE List5.4.1 to ≤ 5.4.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMRevive Adserver 5.4.1 - Cross-Site ScriptingCVSS 6.1

A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.

Impact

Allows attackers to execute malicious scripts in the context of a victim's browser

Remediation

Upgrade Revive Adserver to version 5.4.2 or later to mitigate the vulnerability

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2023revive-adserverxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:106844876
FOFA: icon_hash="106844876"
https://hackerone.com/reports/1694171 https://nvd.nist.gov/vuln/detail/CVE-2023-38040

Source: ProjectDiscovery

References

2