| Vulnerability Name: | CVE-2013-3185 (CCN-86072) | ||||||||
| Assigned: | 2013-08-13 | ||||||||
| Published: | 2013-08-13 | ||||||||
| Updated: | 2020-09-28 | ||||||||
| Summary: | Microsoft Active Directory Federation Services (AD FS) 1.x through 2.1 on Windows Server 2003 R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allows remote attackers to obtain sensitive information about the service account, and possibly conduct account-lockout attacks, by connecting to an endpoint, aka "AD FS Information Disclosure Vulnerability." | ||||||||
| CVSS v3 Severity: | 7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
5.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-200 | ||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||
| References: | Source: MITRE Type: CNA CVE-2013-3185 Source: CCN Type: SA54459 Microsoft Windows Active Directory Federation Services Information Disclosure Vulnerability Source: CCN Type: Microsoft Security Bulletin MS13-066 Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (2873872) Source: CCN Type: BID-61672 Microsoft Active Directory Federation Services CVE-2013-3185 Information Disclosure Vulnerability Source: CERT Type: Third Party Advisory, US Government Resource TA13-225A Source: MS Type: UNKNOWN MS13-066 Source: XF Type: UNKNOWN ms-adfs-cve20133185-info-disc(86072) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:18318 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||