CVE-2013-3185: Infoleak
Microsoft Active Directory Federation Services (AD FS) 1.x through 2.1 on Windows Server 2003 R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allows remote attackers to obtain sensitive information about the service account, and possibly conduct account-lockout attacks, by connecting to an endpoint, aka "AD FS Information Disclosure Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3185?
CVE-2013-3185 has a medium severity rating due to the potential for sensitive information disclosure and account-lockout attacks.
How do I fix CVE-2013-3185?
To mitigate CVE-2013-3185, it is recommended to apply the security updates provided by Microsoft for affected versions of AD FS.
Which versions of Active Directory Federation Services are affected by CVE-2013-3185?
CVE-2013-3185 affects Microsoft Active Directory Federation Services versions 2.0 and 2.1 on specified Windows Server editions.
Can CVE-2013-3185 lead to unauthorized access?
While CVE-2013-3185 does not directly allow unauthorized access, it can lead to account-lockout attacks which may disrupt service availability.
What systems are vulnerable to CVE-2013-3185?
Vulnerable systems include Windows Server 2003 R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 with AD FS 2.0 or 2.1 installed.