CVE-2019-1258: Azure Active Directory Authentication Library Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens, aka 'Azure Active Directory Authentication Library Elevation of Privilege Vulnerability'.
Other sources
An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated attacker to perform actions in context of another user. The authenticated attacker can exploit this vulneraiblity by accessing a service configured for On-Behalf-Of flow that assigns incorrect tokens. This security update addresses the vulnerability by removing fallback cache look-up for On-Behalf-Of scenarios.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-1258?
CVE-2019-1258 is a vulnerability in Azure Active Directory Authentication Library (ADAL) that allows an attacker to elevate their privileges.
What is the severity of CVE-2019-1258?
CVE-2019-1258 has a severity rating of 8.8 (high).
Which software is affected by CVE-2019-1258?
The affected software is Microsoft Active Directory Authentication Library (ADAL) versions 5.0.5 to 5.2.0 and Microsoft Nuget version 5.2.0.
How does CVE-2019-1258 work?
CVE-2019-1258 exploits the way Azure Active Directory Authentication Library (ADAL) caches tokens to gain elevated privileges.
Is there a fix for CVE-2019-1258?
Yes, Microsoft has released a security advisory with guidance on how to mitigate the CVE-2019-1258 vulnerability.