CVE-2016-9128

MEDIUM

Revive Adserver <3.2.3 - XSS

Title source: llm

Description

Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.

References (4)

[Patch, Third Party Advisory] https://github.com/revive-adserver/revive-adserver/commit/a323fd626627e8d42819fd5b7e2829196b5c54a3

View Patch ZIP pw:eip

[Issue Tracking, Patch, Third Party Advisory] https://github.com/revive-adserver/revive-adserver/commit/e17a7ec3412ded751cda50b82338de471d656d74

[Permissions Required] https://hackerone.com/reports/99004

[Patch, Vendor Advisory] https://www.revive-adserver.com/security/revive-sa-2016-001/

Scores

CVSS v3 5.4

EPSS 0.0031

EPSS Percentile 53.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status published

Affected Products (2)

revive-adserver/revive_adserver < 3.2.2

n/a/Revive Adserver All versions before 3.2.3 < Revive Adserver All versions before 3.2.3

Timeline

Published Mar 28, 2017

Tracked Since Feb 18, 2026