high7.5
CVE-2019-1006
An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens …
Impact
An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net Framework | Versions 2.0, 3.0, 3.5, 4.7.2, 4.8, 3.5.1 |
| Microsoft | Identitymodel | Version 7.0.0 |
| Microsoft | Sharepoint Enterprise Server | Versions 2013, 2016 |
| Microsoft | Sharepoint Foundation | Versions 2010, 2013 |
| Microsoft | Sharepoint Server | Version 2019 |
| Microsoft | Windows 10 | All versions Versions 1607, 1703, 1709, 1803, 1809 |
| Microsoft | Windows 7 | All versions |
| Microsoft | Windows 8.1 | All versions |
| Microsoft | Windows Rt 8.1 | All versions |
| Microsoft | Windows Server 2008 | All versions Version r2 |
| Microsoft | Windows Server 2012 | All versions Version r2 |
| Microsoft | Windows Server 2016 | All versions Versions 1803, 1903 |