CVE-2019-1172: Windows Information Disclosure Vulnerability
An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session, aka 'Windows Information Disclosure Vulnerability'.
Other sources
An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token. The security update addresses the vulnerability by correcting how MSA handles cookies.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1172?
CVE-2019-1172 is classified as a critical information disclosure vulnerability.
How do I fix CVE-2019-1172?
To remediate CVE-2019-1172, apply the latest security updates provided by Microsoft.
What software is affected by CVE-2019-1172?
CVE-2019-1172 affects various versions of Microsoft Windows, including Windows 8.1, Windows 10, and Windows Server.
Can CVE-2019-1172 be exploited remotely?
Yes, CVE-2019-1172 can potentially be exploited by attackers remotely to gain sensitive information.
What type of vulnerability is CVE-2019-1172?
CVE-2019-1172 is an information disclosure vulnerability occurring during the login request session.