BVarsha938602 (Community Member) asked a question.

July 23, 2024 at 11:04 AM
Is there any fix available for CVE-2024-35255 | CWE-362
Privilege Escalation: Azure Identity and Microsoft Authentication are vulnerable to Privilege Escalation.

CVE-2024-35255 | CWE-362

Privilege Escalation: Azure Identity and Microsoft Authentication are vulnerable to Privilege Escalation. The vulnerability is due to improper handling of tokens and keys within DefaultAzureCredential and ManagedIdentityCredential classes, allowing an attacker to elevate to SYSTEM privileges read arbitrary files on the filesystem.

Component

@azure/identity

  • 1 answer
  • 375 views

  • Thilagshan R. (Community Member)

    Hi,

     

    Looking at the component, you are may be using an older version of the azure/identity component. We recommend upgrading to a later version to remediate against this flaw. Upgrade to version 1.11.4 or higher.

     

    Thanks

    Thilagshan

    Expand Post

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.