vulnwire
9.0crit

CVE-2016-9470

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download.

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
0
none known

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain.

Exploit prediction (EPSS)

2.10% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.0CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • n/a Revive Adserver All versions before 3.2.5 and 4.0.0

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-254 7PK - Security Features

References

  • github.com /revive-adserver/revive-adserver/commit/69aacbd2 · x_refsource_MISC, x_transferred
  • hackerone.com /reports/148745 · x_refsource_MISC, x_transferred
  • revive-adserver.com /security/revive-sa-2016-002/ · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.