CVE-2016-9124
Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is…
- Published
- Updated
- Reserved
- Assigned by
- hackerone
Description
Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress.
Timeline
ID reserved
By hackerone
- 5 months later
· 5 months later
Published
- 7 years later
· 7 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 2.2% · top 17% of all CVEs (8 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
Revive Adserver All versions before 3.2.3
- affected Revive Adserver All versions before 3.2.3
References (3)
- https://hackerone.com/reports/96115 (opens in a new tab)x_refsource_MISCx_transferred
- https://www.revive-adserver.com/security/revive-sa-2016-001/ (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/revive-adserver/revive-adserver/commit/847941390f5b3310d51b07c92ec91cc1f4cc82c9 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2016-9124)Record last updated .