Microsoft Active Directory Federation Services vulnerabilities

4 CVEs affecting Microsoft Active Directory Federation Services, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-16794, published 2018-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-3185, published 2013-08-14. Medium severity, CVSS 5.0. EPSS: 40.2% chance of exploitation in the next 30 days. Microsoft Active Directory Federation Services (AD FS) 1.x through 2.1 on Windows Server 2003 R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allows remote attackers to obtain…
CVE-2014-6331, published 2014-11-11. Medium severity, CVSS 5.0. EPSS: 20.3% chance of exploitation in the next 30 days. Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it…
CVE-2015-1757, published 2015-06-10. Medium severity, CVSS 4.3. EPSS: 11% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject…
CVE-2018-16794, published 2018-09-18. High severity, CVSS 8.6. EPSS: 8% chance of exploitation in the next 30 days. Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.