{"id":"CVE-2018-8326","details":"A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server, aka \"Open Source Customization for Active Directory Federation Services XSS Vulnerability.\" This affects Web Customizations.","modified":"2026-07-08T16:41:30.773072Z","published":"2018-07-11T00:29:02.507Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/104656"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1041266"},{"type":"FIX","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8326"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/microsoft/adfswebcustomization","events":[{"introduced":"0"},{"fixed":"d33d082345b18ff5775bfb40fef9233135711655"}],"database_specific":{"cpe":"cpe:2.3:a:microsoft:web_customizations:*:*:*:*:*:active_directory_federation_services:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.1"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8326.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}