Read the docs
TI-2014-01763 Aliases CVE-2014-2230GHSA-w7rj-6f22-g858

Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and…

Priority LOW 30Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

Why it matters now

EPSS 0.01971 80th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:openx:openx:*:*:*:*:*:*:*:*up to 2.8.10VulnerableOpenX
cpe:2.3:a:openx:openx:2.8:*:*:*:*:*:*:*2.8VulnerableOpenX
cpe:2.3:a:openx:openx:2.8.1:*:*:*:*:*:*:*2.8.1VulnerableOpenX
cpe:2.3:a:openx:openx:2.8.2:*:*:*:*:*:*:*2.8.2VulnerableOpenX
cpe:2.3:a:openx:openx:2.8.3:*:*:*:*:*:*:*2.8.3VulnerableOpenX
cpe:2.3:a:openx:openx:2.8.4:*:*:*:*:*:*:*2.8.4VulnerableOpenX
cpe:2.3:a:openx:openx:2.8.5:*:*:*:*:*:*:*2.8.5VulnerableOpenX
cpe:2.3:a:openx:openx:2.8.6:*:*:*:*:*:*:*2.8.6VulnerableOpenX
cpe:2.3:a:openx:openx:2.8.7:*:*:*:*:*:*:*2.8.7VulnerableOpenX
cpe:2.3:a:openx:openx:2.8.8:*:*:*:*:*:*:*2.8.8VulnerableOpenX
  • cpe:2.3:a:openx:openx:*:*:*:*:*:*:*:* Versions up to 2.8.10 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8.3:*:*:*:*:*:*:* Versions 2.8.3 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8.4:*:*:*:*:*:*:* Versions 2.8.4 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8.5:*:*:*:*:*:*:* Versions 2.8.5 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8.6:*:*:*:*:*:*:* Versions 2.8.6 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8.7:*:*:*:*:*:*:* Versions 2.8.7 Vulnerable ·OpenX
  • cpe:2.3:a:openx:openx:2.8.8:*:*:*:*:*:*:* Versions 2.8.8 Vulnerable ·OpenX
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openx:openx:2.8.9:*:*:*:*:*:*:*2.8.9VulnerableOpenX
  • cpe:2.3:a:openx:openx:2.8.9:*:*:*:*:*:*:* Versions 2.8.9 Vulnerable ·OpenX

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-2230
  2. 2026-10-03 Alias added: GHSA-w7rj-6f22-g858

References

Exploit 3

  • TI-2013-03683 Code injection in OpenX Ad Server CVSS 3.1CRITICAL 9.8
  • TI-2009-03887 Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and… CVSS 2.0MEDIUM 6.0
  • TI-2009-00274 Directory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2013-05861 SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery… CVSS 2.0HIGH 7.5
  • TI-2012-04216 SQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before… CVSS 2.0HIGH 7.5
  • TI-2009-04586 Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass… CVSS 2.0HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences