CVE-2019-5433

5.4 mediumEPSS 1.7%

Medium (5.4) in revive-adserver revive adserver. EPSS 1.7% chance of exploitation in the next 30 days.

A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-11-01)
CWE: CWE-601
Published: 2019-05-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

revive-adserver:revive_adserver

References

https://hackerone.com/reports/390663
https://www.revive-adserver.com/security/revive-sa-2019-001/
https://hackerone.com/reports/390663
https://www.revive-adserver.com/security/revive-sa-2019-001/

Check your stack JSON