Azure Identity SDK Remote Code Execution Vulnerability
CVE-2023-36415

8.8HIGH

Key Information:

Vendor
Microsoft
Status
Azure Identity Sdk For Java
Azure Identity Sdk For Python
Azure Identity Sdk For .net
Azure Identity Sdk For Javascript
Vendor
CVE Published:
10 October 2023

Summary

A significant vulnerability exists in the Azure Identity SDK, allowing remote code execution. This flaw enables an attacker to execute arbitrary code on the affected systems, potentially leading to unauthorized access and data compromise. Organizations using the Azure Identity SDK should prioritize patching this vulnerability to safeguard their applications against potential exploitation.

Affected Version(s)

Azure Identity SDK for .NET Unknown 1.0.0 < 1.10.2

Azure Identity SDK for Java Unknown 1.0.0 < 1.10.2

Azure Identity SDK for JavaScript Unknown 3.0.0 < 3.3.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.