CVE-2018-8326

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server, aka "Open Source Customization for Active Directory Federation Services XSS Vulnerability." This affects Web Customizations.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
MicrosoftWeb CustomizationsActive Directory Federation Services

References

Timeline

Published
Jul 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-83279.8A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution VulnerabilCVE-2018-83297.8An Elevation of Privilege vulnerability exists in Windows Subsystem for Linux when it fails to properly handle objects in memory, aka "LinuxCVE-2018-83305.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-83317.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-83328.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Win32k CVE-2018-83337.0An Elevation of Privilege vulnerability exists in Filter Manager when it improperly handles objects in memory, aka "Microsoft Filter ManagerCVE-2018-83357.5A denial of service vulnerability exists in the Microsoft Server Block Message (SMB) when an attacker sends specially crafted requests to thCVE-2018-83365.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel InformationCVE-2018-83375.3A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem CVE-2018-83397.0An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading CVE-2018-83406.5A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authenticatCVE-2018-83414.7An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information
CVE-2018-8326: Medium severity, CVSS 5.4 | Vulnix