CVE-2016-9126 in Adserver

Riassunto

di MITRE

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Prenotare: 31/10/2016
• Divulgazione: 27/03/2017
• Moderazione: accettato
• Voce: VDB-98960
• CPE: pronto
• CWE: CWE-79 (confermato)
• CVSS: 5.4 (NVD)
• EPSS: 0.01446
• KEV: no
• Attività: molto basso
• Settore: Telecommunication, Transportation

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2016-9126
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-9126
• CVE Details: https://www.cvedetails.com/cve/CVE-2016-9126/