Description
Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
References (4)
Core 4
Core References
Vendor Advisory x_refsource_confirm
http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1031195
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-077
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/70938
Scores
EPSS
0.2032
EPSS Percentile
97.2%
Details
CWE
CWE-264
Status
published
Products (3)
microsoft/active_directory_federation_services
2.1
microsoft/active_directory_federation_services
2.0
microsoft/active_directory_federation_services
3.0
Published
Nov 11, 2014
Tracked Since
Feb 18, 2026