Cross-Site Request Forgery in Revive Adserver Affects User Password Recovery
CVE-2016-9127

8.8HIGH

Key Information:

Vendor: Revive-adserver
Status: Revive Adserver All Versions Before 3.2.3
Vendor: CVE Published:; 28 March 2017

🔔 Create Revive-adserver Vulnerability Alert

What is CVE-2016-9127?

Revive Adserver versions prior to 3.2.3 are susceptible to a Cross-Site Request Forgery vulnerability that affects the password recovery feature. Exploiting this vulnerability could allow attackers to trigger mass password recovery emails for registered users, exacerbated by a flaw in the system that sends recovery emails to all users simultaneously. This vulnerability has been addressed in newer versions of the software.