CVE-2016-9128
MEDIUMRevive Adserver < 3.2.3 - Reflected Cross-Site Scripting in affiliate-preview.php
Title source: llmDescription
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
References (4)
Core 4
Core References
Permissions Required x_refsource_misc
https://hackerone.com/reports/99004
Patch, Third Party Advisory x_refsource_misc
https://github.com/revive-adserver/revive-adserver/commit/a323fd626627e8d42819fd5b7e2829196b5c54a3
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/revive-adserver/revive-adserver/commit/e17a7ec3412ded751cda50b82338de471d656d74
Patch, Vendor Advisory x_refsource_misc
https://www.revive-adserver.com/security/revive-sa-2016-001/
Scores
CVSS v3
5.4
EPSS
0.0160
EPSS Percentile
72.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
n/a/Revive Adserver All versions before 3.2.3
Revive Adserver All versions before 3.2.3
revive-adserver/revive_adserver
< 3.2.2
Published
Mar 28, 2017
Tracked Since
Feb 18, 2026