CVE-2016-9125

State: Published
Severity: Not scored
Published: Mar 28, 2017
Updated: Aug 6, 2024
Reserved: Oct 31, 2016

Description

Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.

Scores

The record has no CVSS score.

Weaknesses

CWE-384 Session Fixation (CWE-384)

Affected Products

Product	Versions
Revive Adserver All versions before 3.2.3n/a	Revive Adserver All versions before 3.2.3Affected

References

https://www.revive-adserver.com/security/revive-sa-2016-001/
https://hackerone.com/reports/93813
https://hackerone.com/reports/93809
https://github.com/revive-adserver/revive-adserver/commit/4910365631eabbb208961c36149f41cc8159fb39

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.