GHSA-m5vv-6r4h-3vj9

Source

https://github.com/advisories/GHSA-m5vv-6r4h-3vj9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-m5vv-6r4h-3vj9

Aliases

Downstream

MINI-34q6-m8g2-w2h6

MINI-g24v-f93h-8x4g

MINI-j9pj-fmmc-m75c

MINI-m3h4-9q4g-53p2

Related

Published

2024-06-11T18:30:50Z

Modified

2025-07-22T15:13:59.675350Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Details

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-11T19:57:01Z",
    "severity": "MODERATE",
    "nvd_published_at": "2024-06-11T17:16:03Z"
}

References

Affected packages

Go

github.com/Azure/azure-sdk-for-go/sdk/azidentity

Package

Name: github.com/Azure/azure-sdk-for-go/sdk/azidentity; View open source insights on deps.dev
Purl: pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.0-beta.4.0.20240610221955-50774cd97099

Maven

com.azure:azure-identity

Package

Name: com.azure:azure-identity; View open source insights on deps.dev
Purl: pkg:maven/com.azure/azure-identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.12.2

Affected versions

1.*

1.0.0

1.0.0-preview.1

1.0.0-preview.2

1.0.0-preview.3

1.0.0-preview.4

1.0.0-preview.5

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0-beta.1

1.1.0-beta.2

1.1.0-beta.3

1.1.0-beta.4

1.1.0-beta.5

1.1.0-beta.6

1.1.0-beta.7

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0-beta.1

1.2.0-beta.2

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.3.0-beta.1

1.3.0-beta.2

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0-beta.1

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.5.0-beta.1

1.5.0-beta.2

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.6.0-beta.1

1.6.0

1.6.1

1.7.0-beta.1

1.7.0-beta.2

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0-beta.1

1.8.0

1.8.1

1.8.2

1.8.3

1.9.0-beta.1

1.9.0-beta.2

1.9.0-beta.3

1.9.0

1.9.1

1.9.2

1.10.0-beta.1

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.11.0-beta.1

1.11.0-beta.2

1.11.0

1.11.1

1.11.2

1.11.3

1.11.4

1.12.0-beta.1

1.12.0

1.12.1

com.microsoft.azure:msal4j

Package

Name: com.microsoft.azure:msal4j; View open source insights on deps.dev
Purl: pkg:maven/com.microsoft.azure/msal4j

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.14.4-beta

Fixed

1.15.1

Affected versions

1.*

1.14.4-beta

1.15.0

npm

@azure/identity

Package

Name: @azure/identity; View open source insights on deps.dev
Purl: pkg:npm/%40azure/identity

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.1

@azure/msal-node

Package

Name: @azure/msal-node; View open source insights on deps.dev
Purl: pkg:npm/%40azure/msal-node

Affected ranges

Type: SEMVER
Events: Introduced

2.7.0

Fixed

2.9.2

NuGet

Microsoft.Identity.Client

Package

Name: Microsoft.Identity.Client; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.Identity.Client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.49.1

Fixed

4.60.4

Affected versions

4.*

4.49.1

4.50.0

4.51.0

4.52.0

4.53.0

4.54.0

4.54.1

4.55.0-TestPackage

4.55.0

4.56.0

4.57.0

4.58.0

4.58.1

4.59.0

4.59.1

4.60.0-netonly

4.60.0

4.60.1

4.60.2

4.60.3

Azure.Identity

Package

Name: Azure.Identity; View open source insights on deps.dev
Purl: pkg:nuget/Azure.Identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.4

Affected versions

1.*

1.0.0

1.1.0

1.1.1

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.4.0

1.4.1

1.5.0

1.6.0

1.6.1

1.7.0

1.8.0

1.8.1

1.8.2

1.9.0

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.11.0

1.11.1

1.11.2

1.11.3

Microsoft.Identity.Client

Package

Name: Microsoft.Identity.Client; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.Identity.Client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.61.0

Fixed

4.61.3

Affected versions

4.*

4.61.0

4.61.1

4.61.2

PyPI

azure-identity

Package

Name: azure-identity; View open source insights on deps.dev
Purl: pkg:pypi/azure-identity

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.16.1

Affected versions

1.*

1.0.0b1

1.0.0b2

1.0.0b3

1.0.0b4

1.0.0

1.0.1

1.1.0

1.2.0

1.3.0

1.3.1

1.4.0b1

1.4.0b2

1.4.0b3

1.4.0b4

1.4.0b5

1.4.0b6

1.4.0b7

1.4.0

1.4.1

1.5.0b1

1.5.0b2

1.5.0

1.6.0b1

1.6.0b2

1.6.0b3

1.6.0

1.6.1

1.7.0b1

1.7.0b2

1.7.0b3

1.7.0b4

1.7.0

1.7.1

1.8.0b1

1.8.0

1.9.0b1

1.9.0

1.10.0b1

1.10.0

1.11.0b1

1.11.0b2

1.11.0b3

1.11.0

1.12.0b1

1.12.0b2

1.12.0

1.13.0b1

1.13.0b2

1.13.0b3

1.13.0b4

1.13.0

1.14.0b1

1.14.0b2

1.14.0

1.14.1

1.15.0b1

1.15.0b2

1.15.0

1.16.0b1

1.16.0b2

1.16.0