Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Description

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

Recommendation

Update the @azure/identity package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.2.1
• Patched version(s): 4.2.1

References

• GHSA-m5vv-6r4h-3vj9
• msrc.microsoft.com
• CVE-2024-35255
• CWE-362
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability - CVE-2024-34345
• ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function - CVE-2024-9506
• Stimulsoft Dashboard.JS directory traversal vulnerability - CVE-2024-24398
• Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - CVE-2024-24396

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@azure/identity