CVE-2024-35255Medium· 5.5▾ SunlitAzure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.8%
0.8% → 0.8%
Last analysed / modified upstream
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.
azure-identity < 1.16.1@azure/identity < 4.2.1com.azure:azure-identity < 1.12.2@azure/msal-node >= 2.7.0, < 2.9.2Microsoft.Identity.Client >= 4.49.1, < 4.60.4github.com/Azure/azure-sdk-for-go/sdk/azidentity < 1.6.0-beta.4.0.20240610221955-50774cd97099com.microsoft.azure:msal4j >= 1.14.4-beta, < 1.15.1Azure.Identity < 1.11.4Microsoft.Identity.Client >= 4.61.0, < 4.61.3Upgrade to a patched release:
azure-identity 1.16.1@azure/identity 4.2.1com.azure:azure-identity 1.12.2@azure/msal-node 2.9.2Microsoft.Identity.Client 4.60.4github.com/Azure/azure-sdk-for-go/sdk/azidentity 1.6.0-beta.4.0.20240610221955-50774cd97099com.microsoft.azure:msal4j 1.15.1Azure.Identity 1.11.4Microsoft.Identity.Client 4.61.3