CVE-2015-1757
Active Directory Federation Services - Cross-Site Scripting via wct Parameter
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability."
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/75023
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1032526
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-062
Scores
EPSS
0.1106
EPSS Percentile
95.5%
Details
CWE
CWE-79
Status
published
Products (2)
microsoft/active_directory_federation_services
2.0
microsoft/active_directory_federation_services
2.1
Published
Jun 10, 2015
Tracked Since
Feb 18, 2026