GHSA-xc6x-cq47-9chw

Vulnerability in Azure Active Directory Authentication Library

Source: GitHub Advisory Database (reviewed) High CVE-2019-1258

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	microsoft.identitymodel.clients.activedirectory	>= 5.0.0, < 5.2.0	5.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens, aka 'Azure Active Directory Authentication Library Elevation of Privilege Vulnerability'.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-1258 advisory
https://github.com/AzureAD/azure-activedirectory-library-for-dotnet package
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1258 web