Threats tagged 'ghsa-2r5f-9r69-4q66'

An authorization bypass vulnerability exists in website-index.php in Revive Adserver version 6.0.8 and earlier. This flaw allows an authenticated manager, who is supposed to be restricted to one agency, to view website listings of other agencies by modifying the agencyid request parameter. Although detailed website pages still enforce ownership checks, the disclosed information includes website names, identifiers, and timestamps. The issue is resolved in version 6.0.9 by deriving the agency identifier from the authenticated account rather than the request parameter.