CVE-2016-9457: XSS
Revive Adserver before 3.2.3 suffers from Reflected XSS. www/admin/stats.php is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed, such as setPerPage, pageId, bannerid, periodstart, periodend, and possibly others.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9457?
CVE-2016-9457 is considered a high severity vulnerability due to the potential for reflected XSS attacks.
How do I fix CVE-2016-9457?
To fix CVE-2016-9457, upgrade to Revive Adserver version 3.2.3 or later where the vulnerability is patched.
What versions of Revive Adserver are affected by CVE-2016-9457?
Revive Adserver versions prior to 3.2.3, including 3.2.2 and earlier, are affected by CVE-2016-9457.
What parameters are involved in CVE-2016-9457?
CVE-2016-9457 involves multiple parameters, including setPerPage, pageId, bannerid, period_start, and period_end that are improperly sanitized.
Can CVE-2016-9457 be exploited remotely?
Yes, CVE-2016-9457 can be exploited remotely through reflected XSS attacks by sending crafted requests to the vulnerable application.