vulnwire
9.8crit

CVE-2016-9124

Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts.

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.2%
percentile 83%
Public exploits
0
none known

Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress.

Exploit prediction (EPSS)

2.23% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a Revive Adserver All versions before 3.2.3

Classification

Weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts
  • CWE-287 Improper Authentication

References

  • hackerone.com /reports/96115 · x_refsource_MISC, x_transferred
  • revive-adserver.com /security/revive-sa-2016-001/ · x_refsource_MISC, x_transferred
  • github.com /revive-adserver/revive-adserver/commit/847941390f5b3310d51b07c92ec91cc1f4cc82c9 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.