(MS15-040) Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3045711)

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

  Severity: HIGH

  CVE Identifier: CVE-2015-1638

  Advisory Date: APR 22, 2015

---

  DESCRIPTION

This update resolves an information disclosure vulnerability found in Active Directory Federation Services 3.0 in Windows Server 2012. An attacker who successfully exploits this vulnerability may obtain information contained in the browser even if a user has logged off from the system.

  SOLUTION

  PATCH: https://technet.microsoft.com/en-us/library/security/ms15-040.aspx

  AFFECTED SOFTWARE AND VERSION

• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)

Related Vulnerability

• April 2015 - Microsoft Releases 11 Security Advisories