Azure Identity SDK Remote Code Execution Vulnerability

GHSA ID

GHSA-5mfx-4wcx-rv27

CVE ID

CVE-2023-36414

Severity

high

Published

2023-10-10T18:31:33Z

Updated

2024-06-03T18:31:35Z

CVSS

8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3

8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

CWEs

• CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-36414 ↗
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36414 ↗
• https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/CHANGELOG.md#1102-2023-10-10 ↗
• https://github.com/advisories/GHSA-5mfx-4wcx-rv27 ↗