GHSA-m5vv-6r4h-3vj9

Source

https://github.com/advisories/GHSA-m5vv-6r4h-3vj9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m5vv-6r4h-3vj9

Aliases

Related

Published

2024-06-11T18:30:50Z

Modified

2024-07-15T22:27:04.667309Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Details

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

Database specific

{
    "nvd_published_at": "2024-06-11T17:16:03Z",
    "cwe_ids": [
        "CWE-362"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-11T19:57:01Z"
}

References

Affected packages

PyPI / azure-identity

Package

Name: azure-identity; View open source insights on deps.dev
Purl: pkg:pypi/azure-identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.16.1

Affected versions

1.*

1.0.0b1

1.0.0b2

1.0.0b3

1.0.0b4

1.0.0

1.0.1

1.1.0

1.2.0

1.3.0

1.3.1

1.4.0b1

1.4.0b2

1.4.0b3

1.4.0b4

1.4.0b5

1.4.0b6

1.4.0b7

1.4.0

1.4.1

1.5.0b1

1.5.0b2

1.5.0

1.6.0b1

1.6.0b2

1.6.0b3

1.6.0

1.6.1

1.7.0b1

1.7.0b2

1.7.0b3

1.7.0b4

1.7.0

1.7.1

1.8.0b1

1.8.0

1.9.0b1

1.9.0

1.10.0b1

1.10.0

1.11.0b1

1.11.0b2

1.11.0b3

1.11.0

1.12.0b1

1.12.0b2

1.12.0

1.13.0b1

1.13.0b2

1.13.0b3

1.13.0b4

1.13.0

1.14.0b1

1.14.0b2

1.14.0

1.14.1

1.15.0b1

1.15.0b2

1.15.0

1.16.0b1

1.16.0b2

1.16.0

npm / @azure/identity

Package

Name: @azure/identity; View open source insights on deps.dev
Purl: pkg:npm/%40azure/identity

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.1

Maven / com.azure:azure-identity

Package

Name: com.azure:azure-identity; View open source insights on deps.dev
Purl: pkg:maven/com.azure/azure-identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.12.2

Affected versions

1.*

1.0.0

1.0.0-preview.1

1.0.0-preview.2

1.0.0-preview.3

1.0.0-preview.4

1.0.0-preview.5

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0-beta.1

1.1.0-beta.2

1.1.0-beta.3

1.1.0-beta.4

1.1.0-beta.5

1.1.0-beta.6

1.1.0-beta.7

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0-beta.1

1.2.0-beta.2

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.3.0-beta.1

1.3.0-beta.2

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0-beta.1

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.5.0-beta.1

1.5.0-beta.2

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.6.0-beta.1

1.6.0

1.6.1

1.7.0-beta.1

1.7.0-beta.2

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0-beta.1

1.8.0

1.8.1

1.8.2

1.8.3

1.9.0-beta.1

1.9.0-beta.2

1.9.0-beta.3

1.9.0

1.9.1

1.9.2

1.10.0-beta.1

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.11.0-beta.1

1.11.0-beta.2

1.11.0

1.11.1

1.11.2

1.11.3

1.11.4

1.12.0-beta.1

1.12.0

1.12.1

npm / @azure/msal-node

Package

Name: @azure/msal-node; View open source insights on deps.dev
Purl: pkg:npm/%40azure/msal-node

Affected ranges

Type: SEMVER
Events: Introduced

2.7.0

Fixed

2.9.2

NuGet / Microsoft.Identity.Client

Package

Name: Microsoft.Identity.Client; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.Identity.Client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.49.1

Fixed

4.60.4

Affected versions

4.*

4.49.1

4.50.0

4.51.0

4.52.0

4.53.0

4.54.0

4.54.1

4.55.0-TestPackage

4.55.0

4.56.0

4.57.0

4.58.0

4.58.1

4.59.0

4.59.1

4.60.0-netonly

4.60.0

4.60.1

4.60.2

4.60.3

Go / github.com/Azure/azure-sdk-for-go/sdk/azidentity

Package

Name: github.com/Azure/azure-sdk-for-go/sdk/azidentity; View open source insights on deps.dev
Purl: pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.0

Maven / com.microsoft.azure:msal4j

Package

Name: com.microsoft.azure:msal4j; View open source insights on deps.dev
Purl: pkg:maven/com.microsoft.azure/msal4j

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.14.4-beta

Fixed

1.15.1

Affected versions

1.*

1.14.4-beta

1.15.0

NuGet / Azure.Identity

Package

Name: Azure.Identity; View open source insights on deps.dev
Purl: pkg:nuget/Azure.Identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.4

Affected versions

1.*

1.0.0

1.1.0

1.1.1

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.4.0

1.4.1

1.5.0

1.6.0

1.6.1

1.7.0

1.8.0

1.8.1

1.8.2

1.9.0

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.11.0

1.11.1

1.11.2

1.11.3

NuGet / Microsoft.Identity.Client

Package

Name: Microsoft.Identity.Client; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.Identity.Client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.61.0

Fixed

4.61.3

Affected versions

4.*

4.61.0

4.61.1

4.61.2