CVE-2009-2509

EPSS 17.05%
Veröffentlicht 09.12.2009 18:30:00
Zuletzt bearbeitet 16.06.2026 23:09:36
Erkennungen
Login

Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution in ADFS Vulnerability."

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 6

NVD 5 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ Windows Server 2003 Update sp2

Microsoft ≫ Windows Server 2008 Edition x32

Microsoft ≫ Windows Server 2008 Edition x64

Microsoft ≫ Windows Server 2008 Update sp2 Edition x32

Microsoft ≫ Windows Server 2008 Update sp2 Edition x64

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	17.05%	0.967

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.us-cert.gov/cas/techalerts/TA09-342A.html

US Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441

https://nvd.nist.gov/vuln/detail/CVE-2009-2509

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2009-2509

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2009-2509

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2009-2509