« Volver al listado

CVE-2024-35255

Estado: ModificadaMedia (5.5)—

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Authentication LibraryMicrosoft — Azure Identity SDK

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-35255",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-35255",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-13T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Azure Identity Library",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Identity Library for .NET",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.11.4",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Identity Library for C++",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Identity Library for Java",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.12.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Identity Library for JavaScript",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "4.2.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Identity Library for Python",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.16.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Authentication Library",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.15.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-06-11T17:16:03.550",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de elevación de privilegios en las librerías de identidad de Azure y la librería de autenticación de Microsoft"
    }
  ],
  "lastModified": "2026-07-20T16:16:52.180",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:java:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F13542D-538A-47C1-9BD1-9E0D5CBCE26B",
              "versionEndExcluding": "1.15.1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7C63AFB-7B70-45A6-A9F2-83B413A83951",
              "versionEndIncluding": "2.9.2"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:authentication_library:*:*:*:*:*:.net:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C2C72F0-370B-40C9-BE59-003759D8075D",
              "versionEndExcluding": "4.61.3"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4747CC36-3E5B-40E3-A955-75044682B9B7",
              "versionEndExcluding": "1.6.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:c\\+\\+:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E994EFF7-09AC-4979-A37B-5030C56F0F70",
              "versionEndExcluding": "1.8.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:.net:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D1BABF5-442F-4A95-A608-DEF21245930F",
              "versionEndExcluding": "1.11.4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:java:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EDF4F14-5A4B-4EA4-B1DA-6E3779BF4F8A",
              "versionEndExcluding": "1.12.2"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D509315-188D-403A-B9DC-1104958834F1",
              "versionEndExcluding": "1.16.1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_identity_sdk:*:*:*:*:*:javascript:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BC2D3A8-759D-4BBC-AA63-45D7A52EF907",
              "versionEndExcluding": "4.2.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}