CVE-2024-35255
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Vulnerabilidad de elevación de privilegios en las librerías de identidad de Azure y la librería de autenticación de Microsoft
A flaw was found in Microsoft's Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition—a scenario where the timing of events leads to unexpected behavior—during concurrent operations on shared resources. This can result in privilege escalation, allowing attackers to gain unauthorized access to sensitive information. The vulnerability affects multiple versions of these libraries across various programming languages, including Java, .NET, Node.js, Python, JavaScript, C++, and Go. Microsoft has addressed this issue by releasing updated versions of the affected libraries. Users are strongly advised to upgrade to these patched versions to mitigate potential security risks.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-05-14 CVE Reserved
- 2024-06-11 CVE Published
- 2024-12-17 EPSS Updated
- 2024-12-31 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255 | 2024-06-20 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2024-35255 | 2025-01-21 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2295081 | 2025-01-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Authentication Library Search vendor "Microsoft" for product "Authentication Library" | < 1.15.1 Search vendor "Microsoft" for product "Authentication Library" and version " < 1.15.1" | java |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Authentication Library Search vendor "Microsoft" for product "Authentication Library" | <= 2.9.2 Search vendor "Microsoft" for product "Authentication Library" and version " <= 2.9.2" | node.js |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Authentication Library Search vendor "Microsoft" for product "Authentication Library" | < 4.61.3 Search vendor "Microsoft" for product "Authentication Library" and version " < 4.61.3" | .net |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Azure Identity Sdk Search vendor "Microsoft" for product "Azure Identity Sdk" | < 1.6.0 Search vendor "Microsoft" for product "Azure Identity Sdk" and version " < 1.6.0" | go |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Azure Identity Sdk Search vendor "Microsoft" for product "Azure Identity Sdk" | < 1.8.0 Search vendor "Microsoft" for product "Azure Identity Sdk" and version " < 1.8.0" | c\+\+ |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Azure Identity Sdk Search vendor "Microsoft" for product "Azure Identity Sdk" | < 1.11.4 Search vendor "Microsoft" for product "Azure Identity Sdk" and version " < 1.11.4" | .net |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Azure Identity Sdk Search vendor "Microsoft" for product "Azure Identity Sdk" | < 1.12.2 Search vendor "Microsoft" for product "Azure Identity Sdk" and version " < 1.12.2" | java |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Azure Identity Sdk Search vendor "Microsoft" for product "Azure Identity Sdk" | < 1.16.1 Search vendor "Microsoft" for product "Azure Identity Sdk" and version " < 1.16.1" | python |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Azure Identity Sdk Search vendor "Microsoft" for product "Azure Identity Sdk" | < 4.2.1 Search vendor "Microsoft" for product "Azure Identity Sdk" and version " < 4.2.1" | javascript |
Affected
| ||||||