CVE-2014-6331
5.0
Vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
Exploitability: 10.0 / Impact: 2.9
Source: NVD
Description
Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
Affected (3)
Products: Microsoft: Active Directory Federation Services
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2.1 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows Server 2012 | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2.0 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 2008 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows Server 2012 | Version r2 |
Related CWEs
References (8)
Source: secure@microsoft.com
Vendor Advisory
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Timeline
No history available yet.