### [CVE-2019-5433](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5433)
![](https://img.shields.io/static/v1?label=Product&message=Revive%20Adserver&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Fixed%20version%20v4.2.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Open%20Redirect%20(CWE-601)&color=brightgreen)

### Description

A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0.

### POC

#### Reference
- https://hackerone.com/reports/390663

#### Github
No PoCs found on GitHub currently.