CVE-2016-9456
HighSummary
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts to identify and fix other potential CSRF vulnerabilities.
Risk Assessment
A CSRF attack could allow unauthorized actions on behalf of a logged-in user, potentially leading to serious security breaches within the system.
Recommendation
It is recommended to update Revive Adserver to version 3.2.3 or later to eliminate CSRF vulnerabilities and to conduct a security audit of the admin scripts.
Other vulnerabilities in Revive Adserver
See all- CVE-2026-44959High
A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low-privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery.
- CVE-2026-44958Medium
The vulnerability allows advertiser-level users to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions.
- CVE-2026-34916High
A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low-privileged user to inject malicious PHP code into the compiledlimitations field on the database, resulting in its execution during banner delivery.
- CVE-2016-9455High
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). Several scripts in Revive Adserver's user interface are vulnerable to these attacks.
- CVE-2016-9127High
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF) in the password recovery form. This vulnerability could be exploited to send a large number of password recovery emails to registered users.
- CVE-2015-7372High
Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter.
- CVE-2015-7369High
The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before version 3.2.2 does not restrict access from other domains, allowing remote attackers to conduct cross-domain attacks via unspecified vectors.
- CVE-2015-7367High
Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been deleted or unlinked.
- CVE-2016-9470Critical
Revive Adserver versions before 3.2.5 and 4.0.0 are vulnerable to Reflected File Download (RFD) attacks. Attackers can exploit the vulnerability in `www/delivery/asyncspc.php` to remotely download a file onto the victim's machine.
- CVE-2016-9125Critical
Revive Adserver before 3.2.3 suffers from session fixation, allowing arbitrary session identifiers to be forced. Additionally, it does not invalidate the existing session upon successful authentication, which could enable an attacker to steal an authenticated session.
Original NVD description (English source)
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed.