Bug 2571792 (CVE-2026-108562)
| Summary: | CVE-2026-108562 revive-adserver: Revive Adserver: Stored cross-site scripting via unencoded tracker names | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability-draft | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Revive Adserver. An authenticated user with manager privileges can conduct a stored cross-site scripting (XSS) attack by injecting malicious script code into a tracker name. Because the application fails to properly encode tracker names when displaying maintenance check results, the script executes within an administrator's browser when the maintenance page is opened. This may allow an attacker to hijack administrative sessions or execute unauthorized administrative actions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-11 17:41:47 UTC
|