Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Description

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

Recommendation

Update the @azure/msal-node package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.7.0, < 2.9.2
• Patched version(s): 2.9.2

References

• GHSA-m5vv-6r4h-3vj9
• msrc.microsoft.com
• CVE-2024-35255
• CWE-362
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability (GHSA-m5vv-6r4h-3vj9) - CVE-2024-35255
• @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability - CVE-2024-34345
• ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability - CVE-2024-39309
• Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - CVE-2024-24396

Tags:

npm

@azure/msal-node