CVE-2016-9125

Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
hackeroneCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
VendorProductVersion
revive-adserverrevive_adserver
𝑥
≤ 3.2.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/revive-adserver/revive-adserver/commit/4910365631eabbb208961c36149f41cc8159fb39
https://hackerone.com/reports/93809
https://hackerone.com/reports/93813
https://www.revive-adserver.com/security/revive-sa-2016-001/
https://github.com/revive-adserver/revive-adserver/commit/4910365631eabbb208961c36149f41cc8159fb39
https://hackerone.com/reports/93809
https://hackerone.com/reports/93813
https://www.revive-adserver.com/security/revive-sa-2016-001/