Cross site scripting

2017-03-2802:59:00

PRIOn knowledge base

www.prio-n.com

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.2%

JSON

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.

CPENameOperatorVersion
revive_adserverle3.2.2

CPE	Name	Operator	Version
	revive_adserver	le	3.2.2

References

github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449b3ec

hackerone.com/reports/97073

www.revive-adserver.com/security/revive-sa-2016-001/