CVE-2016-9129: Infoleak
Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9129?
CVE-2016-9129 is classified as a medium severity vulnerability due to its potential impact on user privacy.
How do I fix CVE-2016-9129?
To fix CVE-2016-9129, upgrade your Revive Adserver to version 3.2.3 or later.
What kind of information is exposed in CVE-2016-9129?
CVE-2016-9129 exposes whether an email address is associated with user accounts through the password recovery system.
Which versions of Revive Adserver are affected by CVE-2016-9129?
Revive Adserver versions prior to 3.2.3 are affected by CVE-2016-9129.
What type of vulnerability is CVE-2016-9129?
CVE-2016-9129 is considered an Information Exposure Through Discrepancy vulnerability.