Threats tagged 'ghsa-q8v9-5h9r-rjp3'

Revive Adserver versions 6.0.8 and earlier contain an authorization bypass vulnerability in campaign-zone linking. This flaw allows an authenticated manager or trafficker with zone-linking permissions to link another agency's campaign to their own zone without proper ownership validation. Although foreign banners cannot be linked due to agency filtering, the unauthorized linking exposes the foreign campaign's name, type, and identifier. The issue is resolved in version 6.0.9 by adding campaign ownership validation.