CVE-2015-7370 Cross-site scripting in n/a

What is CVE-2015-7370?

CVE-2015-7370 is a medium-severity cross-site scripting vulnerability in Revive-Adserver Revive Adserver, published on 14 Oct 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2, as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026, allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) data-file parameter.

Weakness: CWE-79

Which versions are affected by CVE-2015-7370?

It affects 1 product.

Products include Revive-Adserver Revive Adserver.

How do I fix CVE-2015-7370?

No fix has been published for CVE-2015-7370 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2015-7370 being exploited?

There is no known exploitation of CVE-2015-7370 in the wild and no public exploit code.

Other vulnerabilities in Revive-Adserver Revive Adserver

• CVE-2016-9124 Security feature bypass in Revive Adserver All versions before 3.2.3 Critical 9.8
• CVE-2016-9125 Auth bypass in Revive Adserver All versions before 3.2.3 Critical 9.8
• CVE-2017-5830 Deserialization in n/a Critical 9.8
• CVE-2016-9470 Other in Revive Adserver All versions before 3.2.5 and 4.0.0 Critical 9.0
• CVE-2026-50741 Code injection in Adserver High 8.8

All Revive-Adserver Revive Adserver vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h5pw-cf2q-m8rq.