PT-2017-9966 · Revive Adserver · Revive Adserver

Karan M. Tank + 1 · Published 2017-03-28 · Updated 2019-10-09 · CVE-2016-9129

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3

Description The issue allows an attacker to determine whether an email address is associated with one or more user accounts by analyzing the message from the password recovery system. However, this information cannot be used directly to log in to the system, as a username is required.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue.

Fix

Side Channel Attack

Information Disclosure

Weakness Enumeration

CWE-203

CWE-200

Related Identifiers

CVE-2016-9129

Affected Products

Revive Adserver

References · 5

• https://github.com/revive-adserver/revive-adserver/commit/38223a841190bebd7a137c7bed84fbbcb2b0c2a5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-9129 · Security Note
• https://revive-adserver.com/security/revive-sa-2016-001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9129 · Vendor Advisory
• https://hackerone.com/reports/98612 · Note