PT-2019-3054 · Microsoft · Azure Active Directory Authentication Library

Published 2019-08-13 · Updated 2024-05-29 · CVE-2019-1258

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Azure Active Directory Authentication Library (affected versions not specified)

Description The issue is related to insecure privilege management in the Azure Active Directory Authentication Library, specifically in the On-Behalf-Of flow, where the library caches tokens. This allows an authenticated attacker to perform actions in the context of another user by accessing a service configured for On-Behalf-Of flow that assigns incorrect tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-264

Related Identifiers

BDU:2019-03036

CVE-2019-1258

GHSA-XC6X-CQ47-9CHW

Affected Products

Azure Active Directory Authentication Library

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-1258 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1258 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xc6x-cq47-9chw · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03036 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1258 · Vendor Advisory
• https://github.com/AzureAD/azure-activedirectory-library-for-dotnet · Note
• https://cvedetails.com/cve/CVE-2019-1258 · Note