CVE-2019-1006

CWE-295 — Improper Certificate ValidationCWE-79 — Cross-site Scripting (XSS)6 documents6 sources
Severity
7.5HIGH
EPSS
2.9%
top 13.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
57
Microsoft Microsoft.identitymodelMicrosoft Microsoft .net Framework 2.0Microsoft Microsoft .net Framework 3.0+54 more
Timeline
PublishedJul 15
Latest updateMay 24

Description

An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages55 packages

▶CVEListV5microsoft/windows20 versions+19
▶NVDmicrosoft/windowsr2, 1803, 1903+2
▶NVDmicrosoft/windows_106 versions+5
▶CVEListV5microsoft/windows_server17 versions+16

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-42m9-f9c6-jjrj: An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAM↗2022-05-24
▶
CVEList
CVE-2019-1006: An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAM↗2019-07-15
▶

📋Vendor Advisories

2
Microsoft
WCF/WIF SAML Token Authentication Bypass Vulnerability↗2019-07-09
▶
Red Hat
struts2: multiple XSS flaws↗2012-02-01
▶

💬Community

1
Bugzilla
CVE-2012-1006 struts2: multiple XSS flaws↗2012-02-07
▶