Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection.

Published 9 y ago 2017-03-28 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.4%

percentile 72%

Public exploits

none known

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fact that such characters are normally ignored when an HTML page is displayed in a browser. The issue could have therefore been exploited for user spoofing, although elevated privileges are required to create users within Revive Adserver.

Exploit prediction (EPSS)

1.37% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	3.1	`CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N`
NVD	2.0	2.1	`AV:N/AC:H/Au:S/C:N/I:P/A:N`

Affected products

n/a Revive Adserver All versions before 3.2.5 and 4.0.0

Classification

Weakness

CWE-75 Failure to Sanitize Special Elements into a Different Plane

References

hackerone.com /reports/128181 · x_refsource_MISC, x_transferred
github.com /revive-adserver/revive-adserver/commit/05b1eceb · x_refsource_MISC, x_transferred
revive-adserver.com /security/revive-sa-2016-002/ · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2016-9471
NVD: CVE-2016-9471

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.