PT-2015-7529 · Revive Adserver · Revive Adserver

N B Sri Harsha · Publicado 2015-10-14 · Atualizado 2018-10-09 · CVE-2015-7366

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2

Description The issue allows remote attackers to hijack user authentication for certain requests, potentially causing a denial of service or modifying user account details. This can be achieved via crafted POST requests to specific scripts, such as account-user-*.php, allowing attackers to perform actions like changing the contact name and language.

Recommendations For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-7366

Produtos afetados

Revive Adserver

Referências · 5

• http://revive-adserver.com/security/revive-sa-2015-001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-7366 · Nota de Segurança
• http://packetstormsecurity.com/files/133893/Revive-Adserver-3.2.1-CSRF-XSS-Local-File-Inclusion.html · Nota
• http://seclists.org/fulldisclosure/2015/Oct/32 · Nota
• http://securityfocus.com/archive/1/536633/100/0/threaded · Nota