CVE-2014-6331
Last modified
CVE-2014-6331 is a vulnerability of currently unknown severity. Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability.". EPSS estimates a 20.32% chance of exploitation in the next 30 days.
Description
Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Active Directory Federation Services | 2.1 |
| Microsoft | Active Directory Federation Services | 2.0 |
| Microsoft | Active Directory Federation Services | 3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-6331?
How severe is CVE-2014-6331?
How do I fix CVE-2014-6331?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-6325Cross-site scripting (XSS) vulnerability in Microsoft Exchan…
- CVE-2014-6326Cross-site scripting (XSS) vulnerability in Microsoft Exchan…
- CVE-2014-6327Microsoft Internet Explorer 11 allows remote attackers to ex…
- CVE-2014-6328Microsoft Internet Explorer 8 through 11 allows remote attac…
- CVE-2014-6329Microsoft Internet Explorer 11 allows remote attackers to ex…
- CVE-2014-6330Microsoft Internet Explorer 9 allows remote attackers to exe…
- CVE-2014-6332OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Wi…8.8
- CVE-2014-6333Microsoft Word 2007 SP3, Word Viewer, and Office Compatibili…
- CVE-2014-6334Microsoft Word 2007 SP3, Word Viewer, and Office Compatibili…
- CVE-2014-6335Microsoft Word 2007 SP3, Word Viewer, and Office Compatibili…
- CVE-2014-6336Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 …
- CVE-2014-6337Microsoft Internet Explorer 10 and 11 allows remote attacker…
Are you affected by CVE-2014-6331?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST