CVE-2018-16794

Name of the Vulnerable Software and Affected Versions Microsoft ADFS versions prior to 4.0 on Windows Server 2016 and previous

Description The issue concerns a Server-Side Request Forgery (SSRF) vulnerability. It can be exploited via the txtBoxEmail parameter in the "/adfs/ls" API endpoint.

Recommendations For Microsoft ADFS versions prior to 4.0 on Windows Server 2016 and previous, as a temporary workaround, consider restricting access to the /adfs/ls API endpoint to minimize the risk of exploitation. Avoid using the txtBoxEmail parameter in the affected API endpoint until the issue is resolved.