Stored Cross-site scripting in Windows and Windows Server - CVE-2018-8547
Published: November 13, 2018
Vulnerability identifier: #VU15846
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-8547
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Microsoft
Affected software:
Windows
Windows Server
Windows
Windows Server
Detailed vulnerability description
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Microsoft Active Directory Federation Services (AD FS). A remote authenticated attacker can send a specially crafted request to the affected AD FS server, store XSS payload on it and execute it in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change permissions and delete content.
How to mitigate CVE-2018-8547
Install updates from vendor's website.