CVE-2019-1258

HIGH8.8EPSS 10.6%

Vulnerability in Azure Active Directory Authentication Library

Published: 8/16/2019Modified: 12/6/2024

Description

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens, aka 'Azure Active Directory Authentication Library Elevation of Privilege Vulnerability'.

Affected packages (1)

NuGet/microsoft.identitymodel.clients.activedirectory>= 5.0.0, < 5.2.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-1258
PATCHhttps://github.com/AzureAD/azure-activedirectory-library-for-dotnet
WEBhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1258