CVE-2019-5434
72Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 57%
from disclosure to weapon211 days
Published on NVDMay 6
1st PoC+211d
VulnCheck+2499d
exploitation probability
57%top 1% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.
Affected products
n/a · Revive Adserverpublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/47739unverifiedcve_referencepacketstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.