CVE-2019-5434

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 4.2.0.

CVSS 3.09.8Critical EPSS percentile99th57% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source Fix4.2.0Upgrade to this build

Published 2019-05-06Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

n/a Revive AdserverAffected: Fixed version v4.2.0Upgrade to: not statedStated by: CVE record
Revive-sas Revive AdserverAffected: < 4.2.0Upgrade to: 4.2.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Revive Adserver (look for the application/version number in the admin panel or server logs).
If you run Revive Adserver, confirm the installed version is below 4.2.0.
Upgrade Revive Adserver to 4.2.0 (or later) from the official vendor guidance.
After upgrading, test XML-RPC functionality used by your ad delivery setup and verify the site still serves ads as expected.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.

In plain language

Written by AI from the record

CVE-2019-5434 is a critical weakness in Revive Adserver that can be triggered by a crafted XML-RPC message to cause harmful PHP behavior; a typical small business running Revive Adserver should act now by upgrading to 4.2.0 or later.

CVE-2019-5434 is an unauthenticated XML-RPC processing flaw in Revive Adserver (openads.spc RPC method) where a crafted payload can reach a PHP unserialize() call on the "what" parameter, enabling PHP object injection-style impacts.

If you're affected

Server compromise
Malware delivery risk
Website/ads disruption
Data exposure

What is it

Imagine Revive Adserver has a remote “message listener” (XML-RPC) that accepts data from the outside. Due to a programming mistake, a specially shaped message can trick the software into treating data in a way it shouldn’t, which can let an attacker take over the server or use it to push harmful content to websites.

Who is affected

This matters if your business runs Revive Adserver (the ad server itself, not just any website that shows ads). The risk is primarily for systems where an attacker can reach the Revive Adserver XML-RPC invocation script over the network, because the flaw is triggered by sending a crafted XML-RPC payload. The findings indicate no fixed mitigation other than upgrading; reachability from the internet (or from an attacker-controlled network path) is the key gate.

How urgent is it

This is RED because a public exploit is available and it targets a high-impact weakness that can lead to server compromise. Attackers do not need a valid account to try the flaw, so exposed installations are the most at risk.

What to do — in detail

Confirm exposure

Identify whether Revive Adserver is installed and running on your servers.
Determine the exact version in use (commonly via the admin interface “About”/version page and/or deployment/package records; also check server logs for the Revive Adserver release identifier).

Check vulnerability status

If your Revive Adserver version is below 4.2.0, you are considered exposed for this CVE.

Upgrade to the fixed version

Upgrade Revive Adserver to 4.2.0 or later.
Follow the vendor’s official security advisory: https://www.revive-adserver.com/security/revive-sa-2019-001/

Temporary workaround (if you cannot patch immediately)

Restrict network access so the XML-RPC invocation script is not reachable from the public internet.
Allow access only from trusted IPs/networks used for your ad operations.
Monitor for repeated requests to the XML-RPC endpoint and unusual error logs around XML parsing/unserialization behavior.

After patching

Verify normal ad serving behavior (smoke test your ad delivery).
Review logs for any suspicious XML-RPC requests that occurred before the upgrade.

Timing

Because this is marked RED and a public exploit exists, prioritize the upgrade as a same-day/urgent change if Revive Adserver is externally reachable.

Technical context

Severity is critical (CVSS 9.8 as provided). The weakness is CWE-502 (deserialization of untrusted data). Mechanism: a crafted payload sent to the XML-RPC invocation script can trigger a PHP unserialize() call on the "what" parameter in the "openads.spc" RPC method. Exploitation status: public exploit available (weaponized); no KEV listing reported. Patch: addressed in Revive Adserver version 4.2.0 per the vendor advisory. KEV is not listed in CISA KEV (so KEV-driven certainty is unavailable from the provided findings), but the presence of a public exploit drives urgent remediation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

57% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-28EPSS band changehigh → moderateepss band change

Affected products

revive-sascommercialaka revivesas
- revive adserverSaaSWeb & CMS Plugins / site-builder

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable