CVE-2019-5440 - CVE House
Back to Database
Status published High CVE-2019-5440

Use of cryptographically weak PRNG in the password recovery token...

Vulnerability Description

Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an attacker exploits the password recovery functionality. In lib/OA/Dal/PasswordRecovery.php, the function generateRecoveryId() generates a password reset token that relies on the PHP uniqid function and consequently depends only on the current server time, which is often visible in an HTTP Date header.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-5440

Credits & Attribution

No credits recorded in the NVD database.

References

More from Revive

View All →
CVE-2025-55129
HackerOne community member Kassem S.(kassem_s94) has reported that username handling...
Medium 5.4
CVE-2025-55128
HackerOne community member Dang Hung Vi (vidang04) has reported an...
Medium 6.5
CVE-2025-55127
HackerOne community member Dao Hoang Anh (yoyomiski) has reported an...
Unknown 0
CVE-2025-55126
HackerOne community member Dang Hung Vi (vidang04) has reported a...
Medium 6.5
CVE-2025-55124
Improper neutralisation of input in Revive Adserver 6.0.0+ causes a...
Medium 6.1

Affected Vendor

Affected Software

Revive Adserver
Vulnerable Versions:
Fixed in 4.2.1

Timeline

Official Publish: May 28th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-338

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.