CVE-2016-9130: XSS
Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The website name wasn't properly escaped when displayed in the campaign-zone.php script.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9130?
The severity of CVE-2016-9130 is classified as medium due to its potential for persistent XSS attacks.
How do I fix CVE-2016-9130?
To fix CVE-2016-9130, upgrade to Revive Adserver version 3.2.3 or later, where the vulnerability has been addressed.
What is the impact of CVE-2016-9130?
The impact of CVE-2016-9130 allows attackers to execute scripts in the context of a victim's browser via stored XSS.
Who is affected by CVE-2016-9130?
Users of Revive Adserver versions prior to 3.2.3 with non-admin accounts are affected by CVE-2016-9130.
What kind of vulnerabilities are related to CVE-2016-9130?
CVE-2016-9130 is related to persistent cross-site scripting (XSS) vulnerabilities in web applications.