Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/149376/Microsoft-ADFS-4.0-Windows-Server-2016-Server-Side-Request-Forgery.html | Exploit Third Party Advisory VDB Entry |
http://seclists.org/fulldisclosure/2018/Sep/13 | Exploit Mailing List Third Party Advisory |
http://www.securityfocus.com/bid/105378 | Third Party Advisory VDB Entry |
https://seclists.org/bugtraq/2018/Sep/26 | Exploit Mailing List Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-09-18T21:00:00
Updated: 2018-09-22T09:57:01
Reserved: 2018-09-10T00:00:00
Link: CVE-2018-16794
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-09-18T21:29:03.247
Modified: 2018-11-20T19:27:20.320
Link: CVE-2018-16794
JSON object: View
Redhat Information
No data.
CWE