CVE-2016-9126

State: Published
Severity: Not scored
Published: Mar 28, 2017
Updated: Aug 6, 2024
Reserved: Oct 31, 2016

Description

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.

Scores

The record has no CVSS score.

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

Affected Products

Product	Versions
Revive Adserver All versions before 3.2.3n/a	Revive Adserver All versions before 3.2.3Affected

References

https://github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449b3ec
https://www.revive-adserver.com/security/revive-sa-2016-001/
https://hackerone.com/reports/97073

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.