CVE-2016-9126 | BDVDB-2026-83297 Detail

Revive Adserver All versions before 3.2.3

Description#

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449b3ec
https://www.revive-adserver.com/security/revive-sa-2016-001/
https://hackerone.com/reports/97073

Exploit#

No public exploit known

History#

Version 12017-03-28Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.