Revive Adserver Security Advisory REVIVE-SA-2017-001
==============================
http://www.revive-adserver.
==============================
CVE-IDs: TBA
Date: 2017-01-31
Risk Level: High
Applications affected: Revive Adserver
Versions affected: <= 4.0.0
Versions not affected: >= 4.0.1
Website: http://www.revive-adserver.
==============================
==============================
Vulnerability 1 - Deserialization of Untrusted Data
==============================
CVE-ID: TBA
CWE-ID: CWE-502
CVSSv3 Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/
CVSSv3 Base Score: 9.8
CVSSv3 Temporal Score: 8.5
==============================
HackerOne user Nicolas Grégoire - Agarri has reported that Revive
Adserver was unserializing untrusted data submitted via cookies in the
delivery scripts. An attacker could use such vector to either perform
generic RCE attacks (e.g. when a vulnerable PHP version is being used)
or, potentially, application-specific attacks.
References
==========
https://cwe.mitre.org/data/
https://github.com/revive-
https://github.com/revive-
==============================
Vulnerability 2 - Session Fixation
==============================
CVE-ID: TBA
CWE-ID: CWE-384
CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:H/UI:N/
CVSSv3 Base Score: 5.9
CVSSv3 Temporal Score: 5.2
==============================
HackerOne user pavanw3b has reported that Revive Adserver wasn't
properly invalidating the current session when setting a new password
via the forgot password mechanism. This could allow attackers having
access to the session ID to keep the authenticated session alive.
References
==========
https://cwe.mitre.org/data/
https://github.com/revive-
==============================
Vulnerability 3 - Persistent XSS
==============================
CVE-ID: TBA
CWE-ID: CWE-79
CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:R/
CVSSv3 Base Score: 4.2
CVSSv3 Temporal Score: 3.7
==============================
HackerOne user pavanw3b has reported that Revive Adserver was vulnerable
to a persistent XSS attack: an authenticated user could set their own
email address to a specifically crafted string which was then displayed
without proper escaping in the context of other users (e.g. the
administrator user), giving them an opportunity to steal a session with
elevated privileges.
References
==========
https://cwe.mitre.org/data/
https://github.com/revive-
==============================
Vulnerability 4 - Reflected XSS
==============================
CVE-ID: TBA
CWE-ID: CWE-79
CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:R/
CVSSv3 Base Score: 4.2
CVSSv3 Temporal Score: 3.7
==============================
HackerOne user pavanw3b has reported that Revive Adserver was vulnerable
to a reflected XSS attack: several of the parameters used in the
invocation code generation for interstitial zones weren't properly
escaped when displayed.
References
==========
https://cwe.mitre.org/data/
https://github.com/revive-
==============================
Solution
==============================
We strongly advise people to upgrade to the most recent 4.0.1
release of Revive Adserver, including those running OpenX Source or
older versions of the application.
==============================
Contact Information
==============================
The security contact for Revive Adserver can be reached at:
<security AT revive-adserver DOT com>.
Please review http://www.revive-adserver.
Komentarų nėra:
Rašyti komentarą