CVE-2018-16794

高危 8.6CVE-2018-16794 · Published 18/09/2018 · updated 17/06/2026

要点

CVE-2018-16794 是影响 active directory federation services (microsoft) 的高危 (CVSS 8.6)漏洞。
未来 30 天内被利用的概率（EPSS）：8.0%，高于 94.8% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
active directory federation services microsoft	`≤ 4.0`	No fix yet

Description

Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.

References

packetstormsecurity.com/files/149376/Microsoft-ADFS-4.0-Windows-Server-2016-Server-Side-Request-Forgery.html · Exploit
seclists.org/fulldisclosure/2018/Sep/13 · Exploit
securityfocus.com/bid/105378 · Third Party Advisory
seclists.org/bugtraq/2018/Sep/26 · Exploit

active directory federation services 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free