Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2009-2508: Active Directory Federation Services may expose prior user credentials

CVE-2009-2508 · published 16 years ago

Summary

Windows Server 2003 and Windows Server 2008 versions that run ADFS can leave a user’s login details in the web browser after they log out. Someone nearby who can access the same computer could retrieve those credentials from the browser cache. Update the servers with the latest security patches or disable the single sign‑on feature until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_server_2003	All versions `cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*`
microsoft	windows_server_2008	All versions `cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*`

Original advisory text

The single sign-on implementation in Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previous user of the same web browser by using data from the browser's cache, aka "Single Sign On Spoofing in ADFS Vulnerability."

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.9 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-255Credentials Management Errors

Timeline

Published9 Dec 2009

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2009-2508 · NVD

Track software like this

Free during beta