PT-2017-10163 · Revive Adserver Team · Revive Adserver

Pavanw3B · Published 2017-03-28 · Updated 2019-10-09 · CVE-2016-9472

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.5 Revive Adserver versions prior to 4.0.0

Description The issue concerns a reflected XSS attack. The Revive Adserver web installer scripts are vulnerable to this attack via parameters such as dbHost and dbUser. The window for such attack vectors is extremely narrow, making it unlikely for an attack to be effective.

Recommendations For Revive Adserver versions prior to 3.2.5, update to version 3.2.5 or later. For Revive Adserver versions prior to 4.0.0, update to version 4.0.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-9472

Affected Products

Revive Adserver

References · 6

• https://github.com/revive-adserver/revive-adserver/commit/fcf72c8a · Patch
• https://revive-adserver.com/security/revive-sa-2016-002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9472 · Security Note
• https://github.com/revive-adserver/revive-adserver/commit/14ff73f0 · Note
• https://hackerone.com/reports/170156 · Note