CVE-2014-6331 Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easie...
MediumCVSS 5.0
EPSS 20.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft active directory federation services | = 2.1 | No fix listed |
| Microsoft active directory federation services | = 2.0 | No fix listed |
| Microsoft active directory federation services | = 3.0 | No fix listed |
References
- blogs.technet.com vendor-advisory
- 70938 vdb-entry
- 1031195 vdb-entry
- MS14-077 vendor-advisory