Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Active Directory Federation Services may execute injected web scripts

CVE-2015-1757 · published 11 years ago
Summary

The AD FS component on Windows Server 2008 SP2, Windows Server 2008 R2 SP1, and Windows Server 2012 can be tricked into running malicious web code through a specific request parameter. This could let remote attackers capture user data or take over user sessions. Apply the latest Microsoft security updates for AD FS and keep the servers patched to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft active_directory_federation_services 2.0
2.1
cpe:2.3:a:microsoft:active_directory_federation_services:2.0:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject...
Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability."
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
11% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Jun 2015
Updated17 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-1757 · NVD
Track software like this
Free during beta