Vulnerability CVE-2014-6331
Published: 2014-11-11   Modified: 2014-11-12

Description:
Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Microsoft -> Active directory federation services 

 References:
http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx
http://www.securityfocus.com/bid/70938
http://www.securitytracker.com/id/1031195
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-077
Copyright 2024, cxsecurity.com

 

Back to Top