PT-2017-10147 · Revive Adserver · Revive Adserver

Published 2017-03-28 · Updated 2017-03-30 · CVE-2016-9456

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3

Description The issue affects the admin interface scripts, allowing for Cross-Site Request Forgery (CSRF) attacks. A security audit identified and fixed over 20 potential CSRF vulnerabilities.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-9456

Affected Products

Revive Adserver

References · 5

• https://github.com/revive-adserver/revive-adserver/commit/e563ca61e4f3b7210cb61f53284adaa8aef4a49a · Patch
• https://revive-adserver.com/security/revive-sa-2016-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9456 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9456 · Vendor Advisory
• http://securityfocus.com/bid/83964 · Note