CVE-2016-9129: revive-adserver revive_adserver Observable Discrepancy
Vulnerability summary
CVE-2016-9129 is a medium (CVSS 5.3) Observable Discrepancy vulnerability in revive-adserver revive_adserver. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.8% of scored vulnerabilities.
Timeline
- 28-03-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.43% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Revive-adserver1 product
- revive_adserver≤ 3.2.2
1 vendor · 1 product
References
3 links- github.com/revive-adserver/revive-adserver/commit/38223a841190bebd7a137c7bed84fbbcb2b0c2a5X Refsource MISCIssue TrackingPatchThird Party Advisory