CVE-2016-9472: XSS
First published: Tue Mar 28 2017(Updated: )
Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost, dbUser, and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narrow and it is very unlikely that such an attack could be actually effective.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Revive Adserver | <=3.2.4 | |
| Revive Adserver | =4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-9472?
CVE-2016-9472 is classified as a medium severity vulnerability due to its potential for exploitation via reflected XSS attacks.
How do I fix CVE-2016-9472?
To resolve CVE-2016-9472, upgrade to Revive Adserver version 3.2.5 or later, or version 4.0.1 or later.
What impact does CVE-2016-9472 have on my system?
CVE-2016-9472 can allow an attacker to execute arbitrary scripts in the context of the user’s browser, leading to potential data theft or session hijacking.
Who is affected by CVE-2016-9472?
Users of Revive Adserver versions prior to 3.2.5 and 4.0.0 are affected by CVE-2016-9472.
Is CVE-2016-9472 exploit publicly available?
Exploits for CVE-2016-9472 may not be widely publicized, but the vulnerability itself poses a risk if the affected software versions are in use.
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/revive-adserver
- canonical/revive adserver
- version/revive adserver/3.2.4
- version/revive adserver/4.0.0