CVE-2016-9125 Auth bypass in Revive Adserver All versions before 3.2.3
Attackers can hijack authenticated sessions in Revive Adserver by forcing session identifiers and exploiting lack of session invalidation upon login.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-9125?
CVE-2016-9125 is a critical authentication bypass vulnerability in Revive-Adserver Revive Adserver, published on 28 Mar 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.
Weakness: CWE-384
Which versions are affected by CVE-2016-9125?
It affects 1 product.
Products include Revive-Adserver Revive Adserver.
How do I fix CVE-2016-9125?
No fix has been published for CVE-2016-9125 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-9125 being exploited?
There is no known exploitation of CVE-2016-9125 in the wild and no public exploit code.
Other vulnerabilities in Revive-Adserver Revive Adserver
Sources
Also known as GHSA-22mq-h6q3-chp7.