VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 15, 2019· Updated Jun 17, 2026

CVE-2019-1006

CVE-2019-1006

Description

An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.

Affected products

90
  • Microsoft/.net Framework20 versions
    cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*+ 19 more
    • cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*
    • (no CPE)range: Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2
    • (no CPE)range: Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2
    • (no CPE)range: Windows Server 2012
    • (no CPE)range: Windows 7 for 32-bit Systems Service Pack 1
    • (no CPE)range: Windows 7 for 32-bit Systems Service Pack 1
    • (no CPE)range: Windows Server 2008 for 32-bit Systems Service Pack 2
    • (no CPE)range: Windows 10 for 32-bit Systems
    • (no CPE)range: Windows 7 for 32-bit Systems Service Pack 1
  • Microsoft/Identitymodel
    cpe:2.3:a:microsoft:identitymodel:7.0.0:*:*:*:*:*:*:*
  • Microsoft/Sharepoint Server5 versions
    cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
    • (no CPE)range: 2016
    • (no CPE)range: 2019
  • Microsoft/Sharepoint Foundation3 versions
    cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
    • (no CPE)range: 2010 Service Pack 2
  • Microsoft/Windows 10 19097 versions
    cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*
  • Microsoft/Windows 7
    cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • Microsoft/Windows 8.1
    cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
  • Microsoft/Windows Rt 8.1
    cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • Microsoft/Windows Server 20083 versions
    cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
    • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • Microsoft/Windows Server 20122 versions
    cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • Microsoft/Windows Server 20163 versions
    cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*
  • Microsoft/Windows Server 2019
    cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
  • Microsoft/Windows Communication Foundation (WCF)llm-fuzzy
  • Microsoft/Windows Identity Foundation (WIF)llm-fuzzy
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation)v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for 32-bit Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for x64-based Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation)v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1903 (Server Core installation)v5
    Range: 1903
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 10 Version 1703 for 32-bit Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 10 Version 1703 for x64-based Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 7 for 32-bit Systems Service Pack 1v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 7 for x64-based Systems Service Pack 1v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 8.1 for 32-bit systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows 8.1 for x64-based systemsv5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows RT 8.1v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server 2012v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation)v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server 2012 R2v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation)v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server 2016v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation)v5
    Range: unspecified
  • Microsoft/Microsoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation)v5
    Range: unspecified
  • Microsoft/Microsoft Identity Webcpe-rescue
    Range: 7.0.0
  • Microsoft/Windows 10 Version 1903 for 32-bit Systemsv5
    Range: unspecified
  • Microsoft/Windows 10 Version 1903 for ARM64-based Systemsv5
    Range: unspecified
  • Microsoft/Windows 10 Version 1903 for x64-based Systemsv5
    Range: unspecified
  • Microsoft/Windows Server 2003cpe-rescue
    Range: 2008 R2 for x64-based Systems Service Pack 1 (Core installation)
  • Microsoft/Windows Server, version 1903 (Server Core installation)v5
    Range: unspecified
  • Microsoft/Windowsv5
    Range: 7 for 32-bit Systems Service Pack 1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.