CVE-2016-9125
CriticalSummary
Revive Adserver before 3.2.3 suffers from session fixation, allowing arbitrary session identifiers to be forced. Additionally, it does not invalidate the existing session upon successful authentication, which could enable an attacker to steal an authenticated session.
Risk Assessment
The risk to the organization is the potential for an attacker to hijack a user's session, leading to unauthorized access to system data and functions.
Recommendation
It is recommended to update Revive Adserver to version 3.2.3 or later to mitigate this vulnerability and implement additional measures to secure user sessions.
Original NVD description (English source)
Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.