{"id":"GHSA-m5vv-6r4h-3vj9","summary":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability","details":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.","aliases":["CVE-2024-35255","GO-2024-2918","PYSEC-2026-1209"],"modified":"2026-07-17T21:09:01.636321503Z","published":"2024-06-11T18:30:50Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2024-06-11T19:57:01Z","nvd_published_at":"2024-06-11T17:16:03Z","cwe_ids":["CWE-362"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35255"},{"type":"WEB","url":"https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"}],"affected":[{"package":{"name":"azure-identity","ecosystem":"PyPI","purl":"pkg:pypi/azure-identity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1"}]}],"versions":["1.0.0","1.0.0b1","1.0.0b2","1.0.0b3","1.0.0b4","1.0.1","1.1.0","1.10.0","1.10.0b1","1.11.0","1.11.0b1","1.11.0b2","1.11.0b3","1.12.0","1.12.0b1","1.12.0b2","1.13.0","1.13.0b1","1.13.0b2","1.13.0b3","1.13.0b4","1.14.0","1.14.0b1","1.14.0b2","1.14.1","1.15.0","1.15.0b1","1.15.0b2","1.16.0","1.16.0b1","1.16.0b2","1.2.0","1.3.0","1.3.1","1.4.0","1.4.0b1","1.4.0b2","1.4.0b3","1.4.0b4","1.4.0b5","1.4.0b6","1.4.0b7","1.4.1","1.5.0","1.5.0b1","1.5.0b2","1.6.0","1.6.0b1","1.6.0b2","1.6.0b3","1.6.1","1.7.0","1.7.0b1","1.7.0b2","1.7.0b3","1.7.0b4","1.7.1","1.8.0","1.8.0b1","1.9.0","1.9.0b1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}},{"package":{"name":"@azure/identity","ecosystem":"npm","purl":"pkg:npm/%40azure/identity"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}},{"package":{"name":"com.azure:azure-identity","ecosystem":"Maven","purl":"pkg:maven/com.azure/azure-identity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2"}]}],"versions":["1.0.0","1.0.0-preview.1","1.0.0-preview.2","1.0.0-preview.3","1.0.0-preview.4","1.0.0-preview.5","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.0-beta.1","1.1.0-beta.2","1.1.0-beta.3","1.1.0-beta.4","1.1.0-beta.5","1.1.0-beta.6","1.1.0-beta.7","1.1.1","1.1.2","1.1.3","1.10.0","1.10.0-beta.1","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.0-beta.1","1.11.0-beta.2","1.11.1","1.11.2","1.11.3","1.11.4","1.12.0","1.12.0-beta.1","1.12.1","1.2.0","1.2.0-beta.1","1.2.0-beta.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","1.3.0-beta.1","1.3.0-beta.2","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4.0","1.4.0-beta.1","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.5.0","1.5.0-beta.1","1.5.0-beta.2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0-beta.1","1.6.1","1.7.0","1.7.0-beta.1","1.7.0-beta.2","1.7.1","1.7.2","1.7.3","1.8.0","1.8.0-beta.1","1.8.1","1.8.2","1.8.3","1.9.0","1.9.0-beta.1","1.9.0-beta.2","1.9.0-beta.3","1.9.1","1.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}},{"package":{"name":"@azure/msal-node","ecosystem":"npm","purl":"pkg:npm/%40azure/msal-node"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.7.0"},{"fixed":"2.9.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}},{"package":{"name":"Microsoft.Identity.Client","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Identity.Client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.49.1"},{"fixed":"4.60.4"}]}],"versions":["4.49.1","4.50.0","4.51.0","4.52.0","4.53.0","4.54.0","4.54.1","4.55.0","4.55.0-TestPackage","4.56.0","4.57.0","4.58.0","4.58.1","4.59.0","4.59.1","4.60.0","4.60.0-netonly","4.60.1","4.60.2","4.60.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}},{"package":{"name":"github.com/Azure/azure-sdk-for-go/sdk/azidentity","ecosystem":"Go","purl":"pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0-beta.4.0.20240610221955-50774cd97099"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}},{"package":{"name":"com.microsoft.azure:msal4j","ecosystem":"Maven","purl":"pkg:maven/com.microsoft.azure/msal4j"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.4-beta"},{"fixed":"1.15.1"}]}],"versions":["1.14.4-beta","1.15.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}},{"package":{"name":"Azure.Identity","ecosystem":"NuGet","purl":"pkg:nuget/Azure.Identity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4"}]}],"versions":["1.0.0","1.1.0","1.1.1","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.11.3","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.4.0","1.4.1","1.5.0","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.8.2","1.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}},{"package":{"name":"Microsoft.Identity.Client","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Identity.Client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.61.0"},{"fixed":"4.61.3"}]}],"versions":["4.61.0","4.61.1","4.61.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}