GHSA-xc6x-cq47-9chw

Suggest an improvement
Source
https://github.com/advisories/GHSA-xc6x-cq47-9chw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-xc6x-cq47-9chw/GHSA-xc6x-cq47-9chw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xc6x-cq47-9chw
Aliases
Published
2019-08-16T14:03:35Z
Modified
2024-05-31T21:16:46.766402Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Vulnerability in Azure Active Directory Authentication Library
Details

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens, aka 'Azure Active Directory Authentication Library Elevation of Privilege Vulnerability'.

References

Affected packages

NuGet / microsoft.identitymodel.clients.activedirectory

Package

Name
microsoft.identitymodel.clients.activedirectory
View open source insights on deps.dev
Purl
pkg:nuget/microsoft.identitymodel.clients.activedirectory

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.2.0

Affected versions

5.*

5.0.1-preview
5.0.2-preview
5.0.3-preview
5.0.5
5.1.0
5.1.1

Database specific

{
    "last_known_affected_version_range": "<= 5.1.1"
}