CVE-2019-1126 (CNNVD-201907-419)
中文标题:
Microsoft Active Directory Federation Services 安全特征问题漏洞
英文标题:
A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which ...
漏洞描述
中文描述:
Microsoft Windows Server是美国微软（Microsoft）公司的一套服务器操作系统。Active Directory Federation Services（ADFS）是其中的一个联合身份验证服务。 Microsoft ADFS中存在安全漏洞。攻击者可通过运行特制的应用程序利用该漏洞绕过Extranet锁定策略。以下产品及版本受到影响：Microsoft Windows Server 2012 R2，Windows Server 2016，Windows Server 2019，Windows Server版本1803，Windows Server版本1903。
英文描述:
A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout policy.To exploit this vulnerability, an attacker could run a specially crafted application, which would allow an attacker to launch a password brute-force attack or cause account lockouts in Active Directory.This security update corrects how ADFS handles external authentication requests., aka 'ADFS Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0975.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Microsoft | Windows Server | 2012 R2 | - | - |
cpe:2.3:a:microsoft:windows_server:2012_r2:*:*:*:*:*:*:*
|
| Microsoft | Windows Server | 2012 R2 (Core installation) | - | - |
cpe:2.3:a:microsoft:windows_server:2012_r2_(core_installation):*:*:*:*:*:*:*
|
| Microsoft | Windows Server | 2016 | - | - |
cpe:2.3:a:microsoft:windows_server:2016:*:*:*:*:*:*:*
|
| Microsoft | Windows Server | 2016 (Core installation) | - | - |
cpe:2.3:a:microsoft:windows_server:2016__(core_installation):*:*:*:*:*:*:*
|
| Microsoft | Windows Server | version 1803 (Core Installation) | - | - |
cpe:2.3:a:microsoft:windows_server:version_1803__(core_installation):*:*:*:*:*:*:*
|
| Microsoft | Windows Server | 2019 | - | - |
cpe:2.3:a:microsoft:windows_server:2019:*:*:*:*:*:*:*
|
| Microsoft | Windows Server | 2019 (Core installation) | - | - |
cpe:2.3:a:microsoft:windows_server:2019__(core_installation):*:*:*:*:*:*:*
|
| Microsoft | Windows Server, version 1903 (Server Core installation) | unspecified | - | - |
cpe:2.3:a:microsoft:windows_server,_version_1903_(server_core_installation):unspecified:*:*:*:*:*:*:*
|
| microsoft | windows_server_2012 | r2 | - | - |
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
|
| microsoft | windows_server_2016 | - | - | - |
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
|
| microsoft | windows_server_2016 | 1803 | - | - |
cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*
|
| microsoft | windows_server_2016 | 1903 | - | - |
cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*
|
| microsoft | windows_server_2019 | - | - | - |
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-1126 |
2025-11-11 15:20:07 | 2025-11-11 07:35:28 |
| NVD | nvd_CVE-2019-1126 |
2025-11-11 14:56:24 | 2025-11-11 07:44:01 |
| CNNVD | cnnvd_CNNVD-201907-419 |
2025-11-11 15:10:14 | 2025-11-11 07:54:43 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201907-419
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- cvss_score: 未提取 -> 5.3
- cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- cvss_version: NOT_EXTRACTED -> 3.0
- affected_products_count: 8 -> 13
- data_sources: ['cve'] -> ['cve', 'nvd']