CVEvulnerability
CVE-2014-6331
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-11-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
Affected configurations
• microsoft active directory federation services 2.1
• microsoft active directory federation services 2.0
• microsoft active directory federation services 3.0
Related
Weakness · not in database (1)
References
- http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx Vendor Advisory
- http://www.securityfocus.com/bid/70938 www.securityfocus.com
- http://www.securitytracker.com/id/1031195 www.securitytracker.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-077 docs.microsoft.com
- http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx Vendor Advisory
- http://www.securityfocus.com/bid/70938 www.securityfocus.com
- http://www.securitytracker.com/id/1031195 www.securitytracker.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-077 docs.microsoft.com