PT-2017-9962 · Revive Adserver Team · Revive Adserver

Kamini Singh + 1 · Publicado 2017-03-28 · Atualizado 2019-10-09 · CVE-2016-9125

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3

Description The issue allows arbitrary session identifiers to be forced and does not invalidate the existing session upon successful authentication, potentially enabling an attacker to steal an authenticated session under certain circumstances.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2016-9125

Produtos afetados

Revive Adserver

Referências · 6

• https://github.com/revive-adserver/revive-adserver/commit/4910365631eabbb208961c36149f41cc8159fb39 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-9125 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9125 · Aviso do Fabricante
• https://hackerone.com/reports/93813 · Nota
• https://hackerone.com/reports/93809 · Nota
• https://revive-adserver.com/security/revive-sa-2016-001 · Aviso do Fabricante