VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 9, 2009· Updated Jun 16, 2026

CVE-2009-2508

CVE-2009-2508

Description

The single sign-on implementation in Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previous user of the same web browser by using data from the browser's cache, aka "Single Sign On Spoofing in ADFS Vulnerability."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Microsoft/Windows Server 2003
    cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • Microsoft/Windows Server 20084 versions
    cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*+ 3 more
    • cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
  • Microsoft/Active Directory Federation Servicesllm-fuzzy
    Range: Windows Server 2003 SP2, Windows Server 2008 Gold and SP2

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.