CVE-2016-9126

MEDIUM

Revive Adserver < 3.2.3 - Authenticated Stored Cross-Site Scripting in Audit Trail Widget

Title source: llm
STIX 2.1

Description

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_misc
https://www.revive-adserver.com/security/revive-sa-2016-001/
Permissions Required x_refsource_misc
https://hackerone.com/reports/97073

Scores

CVSS v3 5.4
EPSS 0.0145
EPSS Percentile 69.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
n/a/Revive Adserver All versions before 3.2.3 Revive Adserver All versions before 3.2.3
revive-adserver/revive_adserver < 3.2.2
Published Mar 28, 2017
Tracked Since Feb 18, 2026