Description
Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost, dbUser, and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narrow and it is very unlikely that such an attack could be actually effective.
Metrics
CVSS 3.0 5.4/10
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | Revive Adserver All versions before 3.2.5 and 4.0.0 | Revive Adserver All versions before 3.2.5 and 4.0.0 |
References
- https://github.com/revive-adserver/revive-adserver/commit/14ff73f0Permissions Required, Third Party Advisory
- https://github.com/revive-adserver/revive-adserver/commit/fcf72c8aPatch, Third Party Advisory
- https://hackerone.com/reports/170156Permissions Required
- https://www.revive-adserver.com/security/revive-sa-2016-002/Patch, Vendor Advisory
- https://github.com/revive-adserver/revive-adserver/commit/14ff73f0Permissions Required, Third Party Advisory
- https://github.com/revive-adserver/revive-adserver/commit/fcf72c8aPatch, Third Party Advisory
- https://hackerone.com/reports/170156Permissions Required
- https://www.revive-adserver.com/security/revive-sa-2016-002/Patch, Vendor Advisory
Timeline
- Published
- Mar 28, 2017
- Last modified
- Jun 17, 2026
- NVD status
- Modified