PT-2018-4407 · Iab · Openrtb

Publicado 2018-10-30 · Atualizado 2019-01-29 · CVE-2015-7266

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IAB OpenRTB version 2.3

Description The issue concerns the Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation, which might allow remote attackers to conceal the status of ad transactions and potentially compromise bid integrity. This is due to the failure to limit the time between bid responses and impression notifications.

Recommendations For IAB OpenRTB version 2.3, consider implementing time limits between bid responses and impression notifications to prevent exploitation of this issue. As a temporary workaround, restrict access to bid transaction status to minimize the risk of bid integrity compromise.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-7266

Produtos afetados

Openrtb

Referências · 2

• 🔥 http://media.pixalate.com/white-papers/xindi.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7266 · Nota de Segurança