CVE-2016-9470

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain.

CVSS v3 9.0 CRITICAL
CVSS v2.0 9.3 HIGH

9.0^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/revive-adserver/revive-adserver/commit/69aacbd2	Patch Third Party Advisory
https://hackerone.com/reports/148745	Permissions Required
https://www.revive-adserver.com/security/revive-sa-2016-002/	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:revive-adserver:revive_adserver::::::::
	cpe:2.3:a:revive-adserver:revive_adserver:4.0.0:::::::*

History

No history.

Information

Published : 2017-03-28 02:59

Updated : 2024-02-04 19:11

NVD link : CVE-2016-9470

Mitre link : CVE-2016-9470

CVE.ORG link : CVE-2016-9470

JSON object : View

Products Affected

revive-adserver

revive_adserver

CWE

CWE-254

7PK - Security Features

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2016-9470", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2017-03-28T02:59:01.307", "references": [{"url": "https://github.com/revive-adserver/revive-adserver/commit/69aacbd2", "tags": ["Patch", "Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "https://hackerone.com/reports/148745", "tags": ["Permissions Required"], "source": "support@hackerone.com"}, {"url": "https://www.revive-adserver.com/security/revive-sa-2016-002/", "tags": ["Patch", "Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-254"}]}, {"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain."}, {"lang": "es", "value": "Revive Adserver en versiones anteriores a 3.2.5 y 4.0.0 sufre de Reflected File Download. `www/delivery/asyncspc.php` era vulnerable al relativamente nuevo vector de ataque web Reflected File Download (RFD) que permite que atacantes obtengan control completo sobre la m\u00e1quina de la v\u00edctima descargando virtualmente un archivo desde un dominio de confianza."}], "lastModified": "2019-10-09T23:20:30.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34AB418F-BAAC-4C3D-9565-14A5E4F48970", "versionEndIncluding": "3.2.4"}, {"criteria": "cpe:2.3:a:revive-adserver:revive_adserver:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D6CDCD2-5AA9-4CBB-9AB7-3CD6D2A5F23E"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}