CVE-2016-9128: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-03-28T02:59Z
Repository: https://github.com/revive-adserver/revive-adserver
Language: XML
Files changed: plugins_repo/openXInvocationTags/plugins/etc/openXInvocationTags.xml, plugins_repo/openXInvocationTags/plugins/etc/oxInvocationTags/oxInvocationTags.xml
Commit date: 2016-03-01 16:23:10 +0100
Commit message: Bumped openXInvocationTags version

Diff: diff --git a/plugins_repo/openXInvocationTags/plugins/etc/openXInvocationTags.xml b/plugins_repo/openXInvocationTags/plugins/etc/openXInvocationTags.xml
index d324f5575c..11546c3aee 100644
--- a/plugins_repo/openXInvocationTags/plugins/etc/openXInvocationTags.xml
+++ b/plugins_repo/openXInvocationTags/plugins/etc/openXInvocationTags.xml
@@ -2,17 +2,17 @@
 <?xml-stylesheet type="text/xsl" href=""?>
 
 <plugin>
     <name>openXInvocationTags</name>
     <displayName>Invocation Tags Plugin</displayName>
-    <creationDate>2015-05-25</creationDate>
+    <creationDate>2016-02-23</creationDate>
     <author>Revive Adserver</author>
     <authorEmail>revive@revive-adserver.com</authorEmail>
     <authorUrl>http://www.revive-adserver.com</authorUrl>
     <license>GNU Gneral Public License v2</license>
     <description>Plugin that provides invocation tags.</description>
-    <version>1.4.4</version>
+    <version>1.4.5</version>
     <type>package</type>
 
     <install>
 
         <contents>
diff --git a/plugins_repo/openXInvocationTags/plugins/etc/oxInvocationTags/oxInvocationTags.xml b/plugins_repo/openXInvocationTags/plugins/etc/oxInvocationTags/oxInvocationTags.xml
index fb09e70a34..754c91ea07 100644
--- a/plugins_repo/openXInvocationTags/plugins/etc/oxInvocationTags/oxInvocationTags.xml
+++ b/plugins_repo/openXInvocationTags/plugins/etc/oxInvocationTags/oxInvocationTags.xml
@@ -2,17 +2,17 @@
 <?xml-stylesheet type="text/xsl" href=""?>
 
 <plugin>
     <name>oxInvocationTags</name>
     <displayName>Invocation Tags Plugin</displayName>
-    <creationDate>2015-05-25</creationDate>
+    <creationDate>2016-02-23</creationDate>
     <author>Revive Adserver</author>
     <authorEmail>revive@revive-adserver.com</authorEmail>
     <authorUrl>http://www.revive-adserver.com</authorUrl>
     <license>GNU Gneral Public License v2</license>
     <description>Plugin that provides invocation tags for displaying banners on websites.</description>
-    <version>1.4.4</version>
+    <version>1.4.5</version>
     <oxversion>3.2.0-beta-rc3</oxversion>
     <extends>invocationTags</extends>
 
     <install>
         <files>

Vulnerable code:     <creationDate>2015-05-25</creationDate>
    <version>1.4.4</version>
    <creationDate>2015-05-25</creationDate>
    <version>1.4.4</version>
Fixed code:     <creationDate>2016-02-23</creationDate>
    <version>1.4.5</version>
    <creationDate>2016-02-23</creationDate>
    <version>1.4.5</version>