CVE-2018-8547 — Cross-site Scripting in Microsoft Windows 10

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

5.4MEDIUMNVD

EPSS

1.3%

top 20.39%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Windows 10 Microsoft Windows 10 Servers Microsoft Windows 8.1 +5 more

Timeline

PublishedNov 14

Latest updateMay 14

Description

A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server, aka "Active Directory Federation Services XSS Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages9 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation), version 1803 (Server Core Installation)+1

▶CVEListV5microsoft/windows_server_2016(Server Core installation)

▶CVEListV5microsoft/windows_server_2019(Server Core installation)

▶CVEListV5microsoft/windows_server_2012_r2(Server Core installation)

▶NVDmicrosoft/windowsr2, 1709, 1803+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-h6xf-ppj3-93fx: A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does no↗2022-05-14

▶

CVEList

CVE-2018-8547: A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does no↗2018-11-14

▶

📋Vendor Advisories

Microsoft

Active Directory Federation Services XSS Vulnerability↗2018-11-13

▶