CVE-2016-9125 json
Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, b…
published 2017-03-28 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-9942
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.
Patch / fix
Exploit prediction
2.66% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a Revive Adserver All versions before 3.2.3
Classification
- Weakness
-
- CWE-384 Session Fixation
References
-
github.com
/revive-adserver/revive-adserver/commit/4910365631eabbb208961c36149f41cc8159fb39
issue-tracking, patch, third-party-advisory
-
revive-adserver.com
/security/revive-sa-2016-001/
patch, vendor-advisory
-
hackerone.com
/reports/93813
permissions-required
-
hackerone.com
/reports/93809
permissions-required
Sources
- CVE List CVE-2016-9125
- NVD CVE-2016-9125
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.