CVE-2015-1757

Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability."

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/75023
http://www.securitytracker.com/id/1032526
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-062

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:active_directory_federation_services:2.0:::::::*
	cpe:2.3:a:microsoft:active_directory_federation_services:2.1:::::::*

History

No history.

Information

Published : 2015-06-10 01:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-1757

Mitre link : CVE-2015-1757

CVE.ORG link : CVE-2015-1757

JSON object : View

Products Affected

microsoft

active_directory_federation_services

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2015-1757", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-06-10T01:59:29.483", "references": [{"url": "http://www.securityfocus.com/bid/75023", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id/1032526", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-062", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka \"ADFS XSS Elevation of Privilege Vulnerability.\""}, {"lang": "es", "value": "Vulnerabilidad de XSS en adfs/ls en Active Directory Federation Services (AD FS) en Microsoft Windows Server 2008 SP2 y R2 SP1 y Server 2012 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s del par\u00e1metro wct, tambi\u00e9n conocido como 'vulnerabilidad de la elevaci\u00f3n de privilegios de XSS de ADFS.'"}], "lastModified": "2018-10-12T22:09:07.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:active_directory_federation_services:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6254D595-C818-4C2E-956F-3A1B12C812EF"}, {"criteria": "cpe:2.3:a:microsoft:active_directory_federation_services:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "443F8670-CC7C-45B9-AF84-E4EEC5772E46"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}