Security Restriction Bypass in Revive Adserver by Revive Adserver

CVE-2020-8142

What is CVE-2020-8142?

A security restriction bypass vulnerability has been identified in Revive Adserver versions earlier than 5.0.5. This issue allows unauthorized users with access to the admin interface to change the email address or password of the currently logged-in user without entering the correct password. By manipulating the POST request payload, specifically by altering the ‘pwold’ parameter, an attacker can bypass the standard authentication check. This vulnerability emphasizes the importance of securing administrative interfaces and implementing stringent input validation mechanisms to prevent unauthorized data manipulation.

References