PT-2018-9142 · Microsoft · Identity Manager 2016 Sp1

Published 2018-02-26 · Updated 2019-10-03 · CVE-2018-0908

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Identity Manager 2016 SP1

Description: The issue arises from the improper sanitization of a specially crafted attribute value, which is displayed to a user on an affected server. This allows an attacker to gain elevated privileges.

Recommendations: For Microsoft Identity Manager 2016 SP1, ensure that all attribute values are properly sanitized before being displayed to users to prevent elevation of privilege attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-0908

Affected Products

Identity Manager 2016 Sp1

References · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0908 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0908 · Security Note
• http://securityfocus.com/bid/103112 · Note