CVE-2026-34917

4.3 Moyenne

Publiée le 23/06/2026 à 19:16 · Modifiée le 25/06/2026 à 21:52 · Analyse NVD reportée · Source : support@hackerone.com

Description

Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users. An attacker could leverage this to gain unauthorised access and exploit API‑level vulnerabilities. The session context (web/API) is now recorded along with other session data, preventing session IDs from being used interchangeably.

Traduire en français

Produits concernés

Revive Adserver

Scores CVSS

Version	Score	Source	Vecteur
3.0	4.3 Moyenne	support@hackerone.com	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-287

Références

https://hackerone.com/reports/3672641

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories