What’s Vulnerable › Vulnerabilities

CVE-2019-5434

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 57.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-06 · updated 2026-06-17
• Weakness: CWE-502

Description

An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.

Affected products

• Revive-Sas Revive Adserver: before 4.2.0 — fixed in 4.2.0

How to fix

Upgrade to a fixed version: Revive-Sas Revive Adserver 4.2.0. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html
• https://hackerone.com/reports/512076
• https://hackerone.com/reports/542670
• https://www.revive-adserver.com/security/revive-sa-2019-001/
• http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html
• https://hackerone.com/reports/512076
• https://hackerone.com/reports/542670
• https://www.revive-adserver.com/security/revive-sa-2019-001/

Get alerted when CVE-2019-5434 or the next vulnerability affects your stack