CVE-2020-0837

EUVD-2020-2309
<p>An elevation of privilege vulnerability exists when Active Directory Federation Services (ADFS) improperly handles multi-factor authentication requests. An attacker who successfully exploited this vulnerability could bypass some, but not all, of the authentication factors.</p>
<p>To exploit this vulnerability, an attacker could send a specially crafted authentication request.</p>
<p>This security update corrects how ADFS handles multi-factor authentication requests.</p>
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
microsoftCNA
5 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
Affected Products (NVD)
VendorProductVersion
microsoftwindows_server_2016
-
microsoftwindows_server_2019
-
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows 10
1607 (x64, x86)
1809 (arm64, x64, x86)
1903 (arm64, x64, x86)
1909 (arm64, x64, x86)
2004 (arm64, x64, x86)
Windows Server
1903 Server Core
1909 Server Core
2004 Server Core
Windows Server 2016
Server Core
Standard
Windows Server 2019
Server Core
Standard