漏洞标题
N/A
漏洞描述信息
在3.2.3之前，Revive Adserver 遭受了不当限制过度认证尝试的问题。Revive Adserver 的登录页面容易受到密码猜测攻击。考虑了账户锁定功能，但被拒绝了，以避免在此类攻击中向常规用户引入服务中断。 Instead，引入随机延迟作为密码失败的反制措施，并开发了系统来鼓励并行尝试。这些系统将有效地允许有效用户登录 Adserver，即使在攻击正在进行时。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress.
CVSS信息
N/A
漏洞类别
过多认证尝试的限制不恰当
漏洞标题
Revive Adserver 安全漏洞
漏洞描述信息
Revive Adserver是Revive Adserver团队的一套开源的广告管理系统。该系统提供广告投放、广告位管理、数据统计等功能。 Revive Adserver 3.2.3之前的版本中的登录页面存在安全漏洞。攻击者可利用该漏洞猜测用户密码。
CVSS信息
N/A
漏洞类别
授权问题