CVE-2021-22873: Revive Adserver open redirect in delivery scripts

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe flaw is a medium-severity open redirect requiring user interaction, but high EPSS and public exploit references raise the practical risk of phishing abuse.

What it is

Revive Adserver before 5.1.0 allows open redirects through the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. The redirect behavior was originally intentional for third-party ad tracking but was removed and reclassified as a vulnerability. It matters because attackers can craft trusted-looking links that send users to arbitrary external sites.

Impact

An attacker can redirect a victim from a legitimate Revive Adserver domain to an attacker-controlled site, enabling phishing, credential theft, or malware delivery under a trusted link. The CVSS vector shows limited confidentiality and integrity impact with no availability impact.

Attack surface

Reachable over the network via crafted URLs to the lg.php and ck.php delivery scripts; no authentication is required, but the victim must click the link (UI:R). The scope is changed because the redirect leaves the vulnerable application's domain.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.696 (99.3rd percentile), and a HackerOne reference is tagged Exploit, indicating public proof-of-concept material exists. No ransomware usage is documented.

What to do

• Upgrade Revive Adserver to 5.1.0 or later, which removes the open redirect functionality.
• If immediate upgrade is not possible, restrict or validate the dest, oadest, and ct0 parameters on lg.php and ck.php to allow only trusted destinations.
• Place the ad server behind a proxy or WAF rule that blocks external redirect targets in those parameters.
• Review and remove any legacy third-party click-tracking redirect configurations that rely on these parameters.

Detection

• Monitor web logs for requests to lg.php or ck.php with dest, oadest, or ct0 parameters containing external URLs or non-allowlisted domains.
• Alert on HTTP 3xx responses from the ad server where the Location header points to a domain outside your organization.
• Correlate outbound clicks from ad server links with subsequent phishing or malware reports from users.
• Search for known exploit payload patterns from the HackerOne and Packet Storm references in proxy or IDS logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.