Authentication Bypass Vulnerability in Revive Adserver by Sourcefabric

CVE-2019-5440

What is CVE-2019-5440?

The vulnerability in Revive Adserver stems from the use of a weak pseudo-random number generator (PRNG) during the password recovery token generation process. Specifically, the generateRecoveryId() function, found in lib/OA/Dal/PasswordRecovery.php, uses the PHP uniqid function to create a password reset token that is contingent on the server's current time. This exposes the reset token to potential exploitation through an authentication bypass attack, as the predictable nature of the token can be manipulated by attackers utilizing the password recovery functionality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References