CVE-2021-22873

Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.

• CWE-601
• CWE-601

• http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Jan/60Broken Link, Mailing List, Third Party Advisory
• https://github.com/revive-adserver/revive-adserver/issues/1068Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/1081406Exploit, Third Party Advisory
• https://www.revive-adserver.com/security/revive-sa-2021-001/Vendor Advisory
• http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Jan/60Broken Link, Mailing List, Third Party Advisory
• https://github.com/revive-adserver/revive-adserver/issues/1068Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/1081406Exploit, Third Party Advisory
• https://www.revive-adserver.com/security/revive-sa-2021-001/Vendor Advisory

Published

Jan 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22868A path traversal vulnerability was identified in GitHub Ente…4.3
• CVE-2021-22869An improper access control vulnerability in GitHub Enterpris…9.8
• CVE-2021-2287Vulnerability in the Oracle VM VirtualBox product of Oracle …7.1
• CVE-2021-22870A path traversal vulnerability was identified in GitHub Page…6.5
• CVE-2021-22871Revive Adserver before 5.1.0 permits any user with a manager…4.8
• CVE-2021-22872Revive Adserver before 5.1.0 is vulnerable to a reflected cr…6.1
• CVE-2021-22874Revive Adserver before 5.1.1 is vulnerable to a reflected XS…6.1
• CVE-2021-22875Revive Adserver before 5.1.1 is vulnerable to a reflected XS…6.1
• CVE-2021-22876curl 7.1.1 to and including 7.75.0 is vulnerable to an "Expo…5.3
• CVE-2021-22877A missing user check in Nextcloud prior to 20.0.6 inadverten…6.5
• CVE-2021-22878Nextcloud Server prior to 20.0.6 is vulnerable to reflected …4.8
• CVE-2021-22879Nextcloud Desktop Client prior to 3.1.3 is vulnerable to res…8.8