PT-2020-7483

CVE-2013-4211

Published

2020-02-14

Updated

2020-02-19

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: OpenX Ad Server version 2.8.10

Description: A code execution issue exists due to a backdoor in the flowplayer-3.1.1.min.js library, potentially allowing a remote malicious user to execute arbitrary PHP code.

Recommendations: For OpenX Ad Server version 2.8.10, consider removing or disabling the flowplayer-3.1.1.min.js library to prevent exploitation until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Kurt Seifried

Nathan March

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers