CVE-2020-1055: Microsoft Active Directory Federation Services Cross-Site Scripting Vulnerability
A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs, aka 'Microsoft Active Directory Federation Services Cross-Site Scripting Vulnerability'.
Other sources
A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs. An un-authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run scripts in the security context of the current user. This security update addresses the vulnerability by ensuring that ADFS properly sanitizes user inputs.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556799 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4551853
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1055?
CVE-2020-1055 is rated as critical due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2020-1055?
To fix CVE-2020-1055, apply the latest security updates provided by Microsoft for the affected versions.
Which systems are vulnerable to CVE-2020-1055?
CVE-2020-1055 affects specific versions of Microsoft Windows 10 and Windows Server including 1809, 1903, and 1909.
What are the potential impacts of CVE-2020-1055?
Exploitation of CVE-2020-1055 could allow an attacker to execute scripts in the context of a user's session.
How can I determine if I am affected by CVE-2020-1055?
Check your system for any of the vulnerable versions of Microsoft Windows and ensure that your ADFS is updated.