| Vulnerability Name: | CVE-2015-1638 (CCN-101925) | ||||||||
| Assigned: | 2015-04-14 | ||||||||
| Published: | 2015-04-14 | ||||||||
| Updated: | 2019-05-08 | ||||||||
| Summary: | Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability." | ||||||||
| CVSS v3 Severity: | 5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N) 4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
2.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: MITRE Type: CNA CVE-2015-1638 Source: CCN Type: Microsoft Security Bulletin MS15-040 Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3045711) Source: CCN Type: Microsoft Security Bulletin MS16-020 Security Update for Active Directory Federation Services to Address Denial of Service (3134222) Source: SECTRACK Type: UNKNOWN 1032115 Source: MS Type: UNKNOWN MS15-040 Source: XF Type: UNKNOWN ms-adfs-cve20151638-info-disc(101925) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||