| Vulnerability Name: | CVE-2014-6331 (CCN-98363) | ||||||||
| Assigned: | 2014-11-11 | ||||||||
| Published: | 2014-11-11 | ||||||||
| Updated: | 2018-10-12 | ||||||||
| Summary: | Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability." | ||||||||
| CVSS v3 Severity: | 5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
2.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: CONFIRM Type: Vendor Advisory http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx Source: MITRE Type: CNA CVE-2014-6331 Source: CCN Type: Microsoft Security Bulletin MS14-077 Vulnerability in Active Directory Federation Services could allow Information Disclosure (3003381) Source: BID Type: UNKNOWN 70938 Source: CCN Type: BID-70938 Microsoft Active Directory Federation Services CVE-2014-6331 Information Disclosure Vulnerability Source: SECTRACK Type: UNKNOWN 1031195 Source: MS Type: UNKNOWN MS14-077 Source: XF Type: UNKNOWN ms-adfs-cve20146331-info-disc(98363) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||