PT-2025-15702 · Microsoft · Microsoft.Identity.Abstractions+1

Marcelmichau

·

Published

2025-04-09

·

Updated

2025-04-10

·

CVE-2025-32016

CVSS v3.1

4.7

Medium

VectorAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Microsoft Identity Web versions prior to 3.8.2 Microsoft Identity Web versions prior to 3.8.2 is equivalent to Microsoft.Identity.Abstractions versions prior to 9.0.0, however the correct representation is: Microsoft Identity Web versions prior to 3.8.2 Microsoft.Identity.Abstractions versions prior to 9.0.0
Description: This issue affects confidential client applications, including daemons, web apps, and web APIs, and may expose sensitive information such as client secrets or certificate details in service logs under specific circumstances. The exposure can occur when service logs are generated at the information level or when credential descriptions contain local file paths with passwords, Base64 encoded values, or client secrets. Additionally, logs of services using Base64 encoded certificates or certificate paths with password credential descriptions are also affected if the certificates are invalid or expired.
Recommendations: Update to Microsoft.Identity.Web 3.8.2 or Microsoft.Identity.Abstractions 9.0.0 to resolve the issue.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2025-05430
CVE-2025-32016
GHSA-RPQ8-Q44M-2RPG

Affected Products

Identity Web
Microsoft.Identity.Abstractions