PT-2017-9966 · Revive Adserver · Revive Adserver

Karan M. Tank + 1 · Publicado 2017-03-28 · Atualizado 2019-10-09 · CVE-2016-9129

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3

Description The issue allows an attacker to determine whether an email address is associated with one or more user accounts by analyzing the message from the password recovery system. However, this information cannot be used directly to log in to the system, as a username is required.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue.

Correção

Side Channel Attack

Information Disclosure

Enumeração de Fraquezas

CWE-203

CWE-200

Identificadores relacionados

CVE-2016-9129

Produtos afetados

Revive Adserver

Referências · 5

• https://github.com/revive-adserver/revive-adserver/commit/38223a841190bebd7a137c7bed84fbbcb2b0c2a5 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-9129 · Nota de Segurança
• https://hackerone.com/reports/98612 · Nota
• https://revive-adserver.com/security/revive-sa-2016-001 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-9129 · Aviso do Fabricante