CVE-2016-9127

2017-03-2802:46:00

CWE-352

hackerone

www.cve.org

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.4%

JSON

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed.

CNA Affected

[
  {
    "product": "Revive Adserver All versions before 3.2.3",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Revive Adserver All versions before 3.2.3"
      }
    ]
  }
]