CVE-2018-8340: A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authentication requests, aka "AD FS Security…

Description

A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authentication requests, aka "AD FS Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows Server 2012 R2, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)7.9% · higher than 95% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

W1

Windows 10 Servers · Microsoft

version 1709 (Server Core Installation); version 1803 (Server Core Installation) · source: vendor

WS

Windows Server 2012 R2 · Microsoft

(Server Core installation) · source: vendor

WS

Windows Server 2016 · Microsoft

(Server Core installation) · source: vendor, NVD

WS

Windows Server 2012 · Microsoft

r2 · source: NVD