[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

Active Directory Federation Services XSS Vulnerability - CVE-2018-8547

ID: oval:org.secpod.oval:def:49103Date: (C)2018-11-14   (M)2024-03-06
Class: VULNERABILITYFamily: windows




A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected AD FS server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run scripts in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the AD FS site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that the open source customization for AD FS properly sanitizes web requests.

Platform:
Microsoft Windows Server
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2016
Microsoft Windows Server 2019
Microsoft Windows 10
Reference:
CVE-2018-8547
CVE    1
CVE-2018-8547
CPE    16
cpe:/o:microsoft:windows_server_2016:::x64
cpe:/o:microsoft:windows_10:1607:::x64
cpe:/o:microsoft:windows_10:1607:::x86
cpe:/o:microsoft:windows_server_2012::r2:x64
...

© SecPod Technologies