Vulnerability Details : CVE-2016-9129
Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username.
Vulnerability category: Information leak
Products affected by CVE-2016-9129
- cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-9129
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 49 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-9129
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2016-9129
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
-
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.Assigned by: support@hackerone.com (Secondary)
References for CVE-2016-9129
-
https://hackerone.com/reports/98612
Sign inPermissions Required
-
https://www.revive-adserver.com/security/revive-sa-2016-001/
Revive Adserver Security Advisory SA-2016-001Patch;Vendor Advisory
-
https://github.com/revive-adserver/revive-adserver/commit/38223a841190bebd7a137c7bed84fbbcb2b0c2a5
Fix h1 report 98612 · revive-adserver/revive-adserver@38223a8 · GitHubIssue Tracking;Patch;Third Party Advisory
Jump to