Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Published Jun 11, 2024
6.8
MEDIUMCVSS 4.0
EPSS 0.83%
Description
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Affected products
-
- Version 1.0.0StatusaffectedConstraints<1.6.0
- Version
-
- Version 1.0.0StatusaffectedConstraints<1.11.4
- Version
-
- Version 1.0.0StatusaffectedConstraints<1.8.0
- Version
-
- Version 1.0.0StatusaffectedConstraints<1.12.2
- Version
-
- Version 1.0.0StatusaffectedConstraints<4.2.1
- Version
-
- Version 1.0.0StatusaffectedConstraints<1.16.1
- Version
-
- Version 1.0.0StatusaffectedConstraints<1.15.1
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Azure Identity Library | n/a |
| ||||||
| Microsoft | Azure Identity Library for .NET | n/a |
| ||||||
| Microsoft | Azure Identity Library for C++ | n/a |
| ||||||
| Microsoft | Azure Identity Library for Java | n/a |
| ||||||
| Microsoft | Azure Identity Library for JavaScript | n/a |
| ||||||
| Microsoft | Azure Identity Library for Python | n/a |
| ||||||
| Microsoft | Microsoft Authentication Library | n/a |
|
- < 1.15.1
- ≤ 2.9.2
- < 4.61.3
- < 1.6.0
- < 1.8.0
- < 1.11.4
- < 1.12.2
- < 1.16.1
- < 4.2.1
No data.
Red Hat Developer Hub 1.3 on RHEL 9
rhdh/rhdh-hub-rhel9:1.3-100
Fixed · RHBA-2024:7523
Red Hat build of Apache Camel 4 for Quarkus 3
azure-identity
Fixed · RHSA-2024:7052
cert-manager operator for Red Hat OpenShift 1.15
cert-manager/jetstack-cert-manager-acmesolver-rhel9:v1.15.4
Fixed · RHSA-2025:0536
cert-manager operator for Red Hat OpenShift 1.15
cert-manager/jetstack-cert-manager-rhel9:v1.15.4
Fixed · RHSA-2025:0536
Exploit Intelligence
exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
Not affected
Red Hat AI Inference Server
rhaiis/vllm-cpu-rhel9
Not affected
Red Hat AI Inference Server
rhaiis/vllm-tpu-rhel9
Not affected
Red Hat Ansible Automation Platform 2
aap-cloud-metrics-collector-container
Will not fix
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/ansible-builder-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/ee-dellemc-openmanage-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/ee-minimal-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/ee-cloud-services-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/ee-supported-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/platform-resource-runner-rhel8
Not affected
Red Hat Developer Hub
rhdh-operator-container
Not affected
Red Hat Enterprise Linux 10
fence-agents
Not affected
Red Hat Integration Camel K 1
azure-identity
Will not fix
Red Hat OpenShift AI (RHOAI)
rhoai/odh-data-science-pipelines-argo-argoexec-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-kserve-agent-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-kserve-controller-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-kserve-llmisvc-controller-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-kserve-router-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-maas-api-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-gen-ai-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-model-controller-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-model-registry-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-model-serving-api-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-modelmesh-runtime-adapter-rhel9
Fix deferred
Red Hat OpenShift Dev Spaces
devspaces/code-rhel8
Not affected
Red Hat Openshift Data Foundation 4
odf4/mcg-core-rhel8
Not affected
Red Hat build of Apache Camel for Spring Boot 3
azure-identity
Will not fix
Red Hat build of Apache Camel for Spring Boot 4
azure-identity
Not affected
Red Hat build of Quarkus
azure-identity
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Developer Hub 1.3 on RHEL 9 | rhdh/rhdh-hub-rhel9:1.3-100 | Fixed | RHBA-2024:7523 |
| Red Hat build of Apache Camel 4 for Quarkus 3 | azure-identity | Fixed | RHSA-2024:7052 |
| cert-manager operator for Red Hat OpenShift 1.15 | cert-manager/jetstack-cert-manager-acmesolver-rhel9:v1.15.4 | Fixed | RHSA-2025:0536 |
| cert-manager operator for Red Hat OpenShift 1.15 | cert-manager/jetstack-cert-manager-rhel9:v1.15.4 | Fixed | RHSA-2025:0536 |
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Not affected | n/a |
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Not affected | n/a |
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | aap-cloud-metrics-collector-container | Will not fix | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/ansible-builder-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/ee-dellemc-openmanage-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/ee-minimal-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ee-cloud-services-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ee-supported-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/platform-resource-runner-rhel8 | Not affected | n/a |
| Red Hat Developer Hub | rhdh-operator-container | Not affected | n/a |
| Red Hat Enterprise Linux 10 | fence-agents | Not affected | n/a |
| Red Hat Integration Camel K 1 | azure-identity | Will not fix | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-agent-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-controller-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-llmisvc-controller-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-router-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-maas-api-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-gen-ai-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-model-controller-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-model-registry-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-model-serving-api-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-modelmesh-runtime-adapter-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/code-rhel8 | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/mcg-core-rhel8 | Not affected | n/a |
| Red Hat build of Apache Camel for Spring Boot 3 | azure-identity | Will not fix | n/a |
| Red Hat build of Apache Camel for Spring Boot 4 | azure-identity | Not affected | n/a |
| Red Hat build of Quarkus | azure-identity | Will not fix | n/a |
azure-identity
PyPI
Introduced 0 Fixed 1.16.1@azure/msal-node
npm
Introduced 2.7.0 Fixed 2.9.2Microsoft.Identity.Client
NuGet
Introduced 4.49.1 Fixed 4.60.4Microsoft.Identity.Client
NuGet
Introduced 4.61.0 Fixed 4.61.3Azure.Identity
NuGet
Introduced 0 Fixed 1.11.4@azure/identity
npm
Introduced 0 Fixed 4.2.1com.azure:azure-identity
Maven
Introduced 0 Fixed 1.12.2com.microsoft.azure:msal4j
Maven
Introduced 1.14.4-beta Fixed 1.15.1github.com/Azure/azure-sdk-for-go/sdk/azidentity
Go
Introduced 0 Fixed 1.6.0-beta.4.0.20240610221955-50774cd97099
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | azure-identity | 0 | 1.16.1 |
| npm | @azure/msal-node | 2.7.0 | 2.9.2 |
| NuGet | Microsoft.Identity.Client | 4.49.1 | 4.60.4 |
| NuGet | Microsoft.Identity.Client | 4.61.0 | 4.61.3 |
| NuGet | Azure.Identity | 0 | 1.11.4 |
| npm | @azure/identity | 0 | 4.2.1 |
| Maven | com.azure:azure-identity | 0 | 1.12.2 |
| Maven | com.microsoft.azure:msal4j | 1.14.4-beta | 1.15.1 |
| Go | github.com/Azure/azure-sdk-for-go/sdk/azidentity | 0 | 1.6.0-beta.4.0.20240610221955-50774cd97099 |
Remediation
Red Hat statement
Red Hat build of Apache Camel for Spring boot is not affected as 4.4.1 was released containing a fixed version of the Azure Identity Library.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1 other source (CVE.org) ▾
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Jun 11, 2024 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2024–2026- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (5 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.83% (0.00830) | 56.00th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.78% (0.00781) | 50.99th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.21% (0.00206) | 40.95th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.04% (0.00043) | 11.54th | v3 (v2023.03.01) |
| Jun 12, 2024 | 0.04% (0.00043) | 8.92th | v3 (v2023.03.01) |
References (12)
- https://access.redhat.com/security/cve/CVE-2024-35255 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2295081 Issue Tracking
- https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499
- https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d
- https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492
- https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53
- https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178
- https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340
- https://github.com/advisories/GHSA-m5vv-6r4h-3vj9 Advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255 vendor-advisorypatchVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-35255
- https://www.cve.org/CVERecord?id=CVE-2024-35255
Change history (0)
No recorded changes yet.