CVE-2017-0043

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 allows local users to obtain sensitive information via a crafted application, aka "Microsoft Active Directory Federation Services Information Disclosure Vulnerability."

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Microsoft Corporation	Active Directory Federation Services	Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016

References

http://www.securityfocus.com/bid/96628Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038018
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0043Patch, Vendor Advisory
http://www.securityfocus.com/bid/96628Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038018
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0043Patch, Vendor Advisory

Timeline

Published: Mar 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-00455.5Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, CVE-2017-00477.8The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows CVE-2017-00494.3The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a craf CVE-2017-00507.8The kernel API in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7; Windows 8; Windows 10 Gold, 1511, and 1607; Wi CVE-2017-00515.4Microsoft Windows 10 1607 and Windows Server 2016 allow remote attackers to cause a denial of service (application hang) via a crafted Offic CVE-2017-00527.8Microsoft Office Compatibility Pack SP3, Excel 2007 SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3 allow remote attacke CVE-2017-00537.8Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, Word 2010 SP2, Word 2013 SP1, Word 2013 R2 SP1, Word 2016, and Word CVE-2017-00556.1Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server CVE-2017-00567.8The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 CVE-2017-00574.3DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails CVE-2017-00584.7A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. CVE-2017-00594.3Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site,