PT-2017-9963 · Revive Adserver · Revive Adserver

Tengku Zahasman · Publicado 2017-03-28 · Atualizado 2019-10-09 · CVE-2016-9126

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3

Description The issue arises from improper escaping of usernames in the audit trail widget of the dashboard upon login, allowing for persistent XSS attacks. An authenticated user with sufficient privileges to create other users could exploit this to access the administrator account.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the audit trail widget in the dashboard until the update is applied. Additionally, limit the creation of new users to trusted individuals to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-9126

Produtos afetados

Revive Adserver

Referências · 5

• https://github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449b3ec · Correção
• https://hackerone.com/reports/97073 · Nota
• https://osv.dev/vulnerability/CVE-2016-9126 · Aviso do Fabricante
• https://revive-adserver.com/security/revive-sa-2016-001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-9126 · Nota de Segurança