Vulnerability Details CVE-2015-7369
The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.033
EPSS Ranking 86.7%
CVSS Severity
CVSS v2 Score 7.5
References
- http://packetstormsecurity.com/files/133893/Revive-Adserver-3.2.1-CSRF-XSS-Local-File-Inclusion.html
- http://seclists.org/fulldisclosure/2015/Oct/32
- http://www.revive-adserver.com/security/revive-sa-2015-001
- http://www.securityfocus.com/archive/1/536633/100/0/threaded
- http://packetstormsecurity.com/files/133893/Revive-Adserver-3.2.1-CSRF-XSS-Local-File-Inclusion.html
- http://seclists.org/fulldisclosure/2015/Oct/32
- http://www.revive-adserver.com/security/revive-sa-2015-001
- http://www.securityfocus.com/archive/1/536633/100/0/threaded
Products affected by CVE-2015-7369
-
cpe:2.3:a:revive-adserver:revive_adserver:-
-
cpe:2.3:a:revive-adserver:revive_adserver:3.0.0
-
cpe:2.3:a:revive-adserver:revive_adserver:3.0.1
-
cpe:2.3:a:revive-adserver:revive_adserver:3.0.2
-
cpe:2.3:a:revive-adserver:revive_adserver:3.0.3
-
cpe:2.3:a:revive-adserver:revive_adserver:3.0.4
-
cpe:2.3:a:revive-adserver:revive_adserver:3.0.5
-
cpe:2.3:a:revive-adserver:revive_adserver:3.1.0
-
cpe:2.3:a:revive-adserver:revive_adserver:3.2.0
-
cpe:2.3:a:revive-adserver:revive_adserver:3.2.1