Revive Adserver Multiple Security Vulnerabilities



Revive Adserver is prone to the following security vulnerabilities:

1. A brute-force authentication security bypass vulnerability
2. A session-fixation vulnerability
3. Multiple HTML-injection vulnerabilities
4. Multiple cross-site request forgery vulnerability
5. Multiple cross-site scripting vulnerability
6. An information disclosure vulnerability

An attacker can exploit these issues to bypass the authentication mechanism,gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site,steal cookie-based authentication credentials, obtain potentially sensitive information.These may aid in further attacks.

Revive Adserver 3.2.2 and prior are vulnerable.

Information

Bugtraq ID: 83964
Class: Input Validation Error
CVE: CVE-2016-9454
CVE-2016-9455
CVE-2016-9456
CVE-2016-9457
CVE-2016-9124
CVE-2016-9126

Remote: Yes
Local: No
Published: Mar 02 2016 12:00AM
Updated: May 01 2017 12:12AM
Credit: Karan M. Tank and Smit B. Shah,kaviya and Kamini Singh,Tengku Zahasman, @decidedlygray,Johan Caluwe.
Vulnerable: Revive-Adserver Revive Adserver 3.1
Revive-Adserver Revive Adserver 3.0.6
Revive-Adserver Revive Adserver 3.0.5
Revive-Adserver Revive Adserver 3.0.4
Revive-Adserver Revive Adserver 3.0.3
Revive-Adserver Revive Adserver 3.0.2
Revive-Adserver Revive Adserver 3.0.1
Revive-Adserver Revive Adserver 3.2.2
Revive-Adserver Revive Adserver 3.0.0


Not Vulnerable: Revive-Adserver Revive Adserver 3.2.3


Exploit


Attackers can exploit these issues using a browser or readily available tools.


References:

Source: www.securityfocus.com
Related Posts