PT-2017-10145 · Revive Adserver · Revive Adserver

Johan Caluwe · Published 2017-03-28 · Updated 2017-03-30 · CVE-2016-9454

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3

Description The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the improper escaping of the banner image URL for external banners when displayed on most banner-related pages.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the banner image URL for external banners to minimize the risk of exploitation. Avoid using the banner image URL feature in the affected API endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-9454

Affected Products

Revive Adserver

References · 5

• https://github.com/revive-adserver/revive-adserver/commit/f6880330a8e11e804663f132867e9eb9b1f94e83 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-9454 · Security Note
• https://revive-adserver.com/security/revive-sa-2016-001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9454 · Vendor Advisory
• http://securityfocus.com/bid/83964 · Note