CVE-2016-9125

2017-03-2802:46:00

CWE-384

hackerone

www.cve.org

9.5 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.4%

JSON

Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.

CNA Affected

[
  {
    "product": "Revive Adserver All versions before 3.2.3",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Revive Adserver All versions before 3.2.3"
      }
    ]
  }
]