CVE-2018-16794

CVE Database · CVE-2018-16794

CVE-2018-16794

· N/AModified

CVSS v3.1

N/A

EPSS

8.03%

Published

Sep 18, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.

Weaknesses (CWE)

CWE-918

Affected Products (2)

microsoft · active_directory_federation_servicesvulnerable

microsoft · windows_server_2016

References (8)

http://packetstormsecurity.com/files/149376/Microsoft-ADFS-4.0-Windows-Server-2016-Server-Side-Request-Forgery.html

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/Sep/13

ExploitMailing ListThird Party Advisory

http://www.securityfocus.com/bid/105378

Third Party AdvisoryVDB Entry

https://seclists.org/bugtraq/2018/Sep/26

ExploitMailing ListThird Party Advisory

http://packetstormsecurity.com/files/149376/Microsoft-ADFS-4.0-Windows-Server-2016-Server-Side-Request-Forgery.html

KEV Catalog EPSS Scores Vendors All CVEs