CVE-2018-8547 Cross-site scripting in Windows 10

Medium 5.4 Published 14 Nov 2018 Updated 5 Aug 2024

An XSS vulnerability in an AD FS customization allows attackers to execute scripts in the context of the AD FS server, potentially compromising authentication sessions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-8547?

CVE-2018-8547 is a medium-severity cross-site scripting vulnerability in Microsoft Windows 10, published on 14 Nov 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server, aka "Active Directory Federation Services XSS Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

Weakness: CWE-79

Which versions are affected by CVE-2018-8547?

It affects 6 products.

Products include Microsoft Windows 10, Microsoft Windows 8.1, Microsoft Windows Rt 8.1, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019.

How do I fix CVE-2018-8547?

No fix has been published for CVE-2018-8547 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-8547 being exploited?

There is no known exploitation of CVE-2018-8547 in the wild and no public exploit code.

All Microsoft Windows 10 vulnerabilities

Sources

Also known as GHSA-h6xf-ppj3-93fx.