CVE-2016-9124Not scoredCWE-307

CVE-2016-9124: Revive-Adserver Revive Adserver All versions before 3.2.3 vulnerability

Revive-Adserver · Revive Adserver All versions before 3.2.3

Affected: Revive-Adserver Revive Adserver All versions before 3.2.3 · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

2.2%probability of exploitation in the next 30 days

83rd percentile

050100

Higher than 83% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Revive Adserver All versions before 3.2.3Revive Adserver All versions before 3.2.3

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Restriction of Excessive Authentication Attempts · Authentication
Vendor: Revive-Adserver
Published: March 2017
Band: Possible (1 to 10%), March 2017
Bounty reports: 1 disclosed on HackerOne

Disclosed bug bounty reports about CVE-2016-9124

The reports on HackerOne that name this CVE, with HackerOne's own outcome. Titles and metadata only.

CoverageNo articles yet

No CyberSIXT article names CVE-2016-9124 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.