CVE-2016-9470

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain.

Metrics

CVSS 3.0 9.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79 CWE-254

Affected software

Vendor	Product	Versions
n/a	Revive Adserver All versions before 3.2.5 and 4.0.0	Revive Adserver All versions before 3.2.5 and 4.0.0

References

https://github.com/revive-adserver/revive-adserver/commit/69aacbd2Patch, Third Party Advisory
https://hackerone.com/reports/148745Permissions Required
https://www.revive-adserver.com/security/revive-sa-2016-002/Patch, Vendor Advisory
https://github.com/revive-adserver/revive-adserver/commit/69aacbd2Patch, Third Party Advisory
https://hackerone.com/reports/148745Permissions Required
https://www.revive-adserver.com/security/revive-sa-2016-002/Patch, Vendor Advisory

Timeline

Published: Mar 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-94713.1Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a CVE-2016-94725.4Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected CVE-2016-94734.7Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to tr CVE-2016-94797.5The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted reques CVE-2016-94809.1libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed CVE-2016-94819.8In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The meth CVE-2016-94829.8Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator CVE-2016-94839.8The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remot CVE-2016-94847.5The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform CVE-2016-94857.8On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable CVE-2016-94867.8On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable CVE-2016-94877.8EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who sup