CVE-2014-6331
medium · 5Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
5
CVSS
20.3%
EPSS (exploit prob.)
97th
EPSS percentile
2014-11-11
Published
AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-264
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | active_directory_federation_services | 2.1 |
| microsoft | windows_server_2012 | all versions |
| microsoft | active_directory_federation_services | 2.0 |
| microsoft | windows_2008 | all versions |
| microsoft | windows_2008 | all versions |
| microsoft | windows_2008 | r2 |
| microsoft | active_directory_federation_services | 3.0 |
| microsoft | windows_server_2012 | r2 |
Check a specific version with /api/v1/cve/match.
References
- http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx
- http://www.securityfocus.com/bid/70938
- http://www.securitytracker.com/id/1031195
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-077
- http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx
- http://www.securityfocus.com/bid/70938
- http://www.securitytracker.com/id/1031195
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-077
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-6331