CVE-2016-9454: XSS
Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9454?
CVE-2016-9454 has been rated as a medium severity vulnerability due to its potential for persistent XSS attacks.
How do I fix CVE-2016-9454?
To fix CVE-2016-9454, upgrade to Revive Adserver version 3.2.3 or later.
What type of attack does CVE-2016-9454 facilitate?
CVE-2016-9454 facilitates persistent cross-site scripting (XSS) attacks via the user interface of Revive Adserver.
Who is affected by CVE-2016-9454?
Users with trusted (non-admin) accounts on Revive Adserver versions prior to 3.2.3 are affected by CVE-2016-9454.
What specific component of Revive Adserver is vulnerable in CVE-2016-9454?
In CVE-2016-9454, the banner image URL for external banners was not properly escaped, leading to the vulnerability.