PT-2017-10145 · Revive Adserver · Revive Adserver

Johan Caluwe · Publicado 2017-03-28 · Atualizado 2017-03-30 · CVE-2016-9454

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3

Description The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the improper escaping of the banner image URL for external banners when displayed on most banner-related pages.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the banner image URL for external banners to minimize the risk of exploitation. Avoid using the banner image URL feature in the affected API endpoints until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-9454

Produtos afetados

Revive Adserver

Referências · 5

• https://github.com/revive-adserver/revive-adserver/commit/f6880330a8e11e804663f132867e9eb9b1f94e83 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-9454 · Nota de Segurança
• https://revive-adserver.com/security/revive-sa-2016-001 · Aviso do Fabricante
• http://securityfocus.com/bid/83964 · Nota
• https://osv.dev/vulnerability/CVE-2016-9454 · Aviso do Fabricante