{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Vladimir Abramzon with Microsoft"
        ]
      },
      {
        "names": [
          "Eli Arbel with Microsoft"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-35255 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
      },
      {
        "category": "self",
        "summary": "CVE-2024-35255 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-35255.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2024-06-13T07:00:00.000Z",
      "generator": {
        "date": "2025-07-16T00:42:01.213Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-35255",
      "initial_release_date": "2024-06-11T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-06-11T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2024-06-11T07:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "In the Security Updates table, removed Microsoft Authentication Library (MSAL) for Python as it is not affected by CVE-2024-35255."
        },
        {
          "date": "2024-06-12T07:00:00.000Z",
          "legacy_version": "2.1",
          "number": "3",
          "summary": "Added an FAQ. This is an information change only."
        },
        {
          "date": "2024-06-13T07:00:00.000Z",
          "legacy_version": "2.2",
          "number": "4",
          "summary": "Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only."
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.11.4",
            "product": {
              "name": "Azure Identity Library for .NET \u003c1.11.4",
              "product_id": "9"
            }
          },
          {
            "category": "product_version",
            "name": "1.11.4",
            "product": {
              "name": "Azure Identity Library for .NET 1.11.4",
              "product_id": "12334"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity Library for .NET"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.15.1",
            "product": {
              "name": "Microsoft Authentication Library (MSAL) for Java \u003c1.15.1",
              "product_id": "6"
            }
          },
          {
            "category": "product_version",
            "name": "1.15.1",
            "product": {
              "name": "Microsoft Authentication Library (MSAL) for Java 1.15.1",
              "product_id": "12344"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Authentication Library (MSAL) for Java"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.6.0",
            "product": {
              "name": "Azure Identity Library for Go \u003c1.6.0",
              "product_id": "5"
            }
          },
          {
            "category": "product_version",
            "name": "1.6.0",
            "product": {
              "name": "Azure Identity Library for Go 1.6.0",
              "product_id": "12346"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity Library for Go"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c4.61.3",
            "product": {
              "name": "Microsoft Authentication Library (MSAL) for .NET \u003c4.61.3",
              "product_id": "8"
            }
          },
          {
            "category": "product_version",
            "name": "4.61.3",
            "product": {
              "name": "Microsoft Authentication Library (MSAL) for .NET 4.61.3",
              "product_id": "12342"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Authentication Library (MSAL) for .NET"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c2.9.2",
            "product": {
              "name": "Microsoft Authentication Library (MSAL) for Node.js \u003c2.9.2",
              "product_id": "7"
            }
          },
          {
            "category": "product_version",
            "name": "2.9.2",
            "product": {
              "name": "Microsoft Authentication Library (MSAL) for Node.js 2.9.2",
              "product_id": "12343"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Authentication Library (MSAL) for Node.js"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.12.2",
            "product": {
              "name": "Azure Identity Library for Java \u003c1.12.2",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "1.12.2",
            "product": {
              "name": "Azure Identity Library for Java 1.12.2",
              "product_id": "12348"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity Library for Java"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c4.2.1",
            "product": {
              "name": "Azure Identity Library for JavaScript \u003c4.2.1",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "4.2.1",
            "product": {
              "name": "Azure Identity Library for JavaScript 4.2.1",
              "product_id": "12349"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity Library for JavaScript"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.8.0",
            "product": {
              "name": "Azure Identity Library for C++ \u003c1.8.0",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "1.8.0",
            "product": {
              "name": "Azure Identity Library for C++ 1.8.0",
              "product_id": "12347"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity Library for C++"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.16.1",
            "product": {
              "name": "Azure Identity Library for Python \u003c1.16.1",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "1.16.1",
            "product": {
              "name": "Azure Identity Library for Python 1.16.1",
              "product_id": "12350"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity Library for Python"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-35255",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited the vulnerability could elevate privileges and read any file on the file system with SYSTEM access permissions.",
          "title": "What privileges could be gained by an attacker who successfully exploited the vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploits this vulnerability can only obtain read access to the system files by exploiting this vulnerability. The attacker cannot perform write or delete operations on the files.",
          "title": "According to the CVSS metric, Integrity and Availability impact is None (I:N/A:N). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The vulnerability exists in the following credential types:\nDefaultAzureCredential, ManagedIdentityCredential",
          "title": "Which credential types provided by the Azure Identity client library are affected?"
        },
        {
          "category": "faq",
          "text": "The vulnerability exists in the following credential types:\nManagedIdentityApplication (.NET), ManagedIdentityApplication (Java), ManagedIdentityApplication (Node.js)",
          "title": "Which credential types provided by the Microsoft Authentication Libraries are affected?"
        }
      ],
      "product_status": {
        "fixed": [
          "12334",
          "12342",
          "12343",
          "12344",
          "12346",
          "12347",
          "12348",
          "12349",
          "12350"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-35255 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
        },
        {
          "category": "self",
          "summary": "CVE-2024-35255 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-35255.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "1.11.4:Security Update:https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/CHANGELOG.md",
          "product_ids": [
            "9"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/CHANGELOG.md"
        },
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "1.15.1:Security Update:https://github.com/AzureAD/microsoft-authentication-library-for-java",
          "product_ids": [
            "6"
          ],
          "url": "https://github.com/AzureAD/microsoft-authentication-library-for-java"
        },
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "1.6.0:Security Update:https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/CHANGELOG.md",
          "product_ids": [
            "5"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/CHANGELOG.md"
        },
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "4.61.3:Security Update:https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/CHANGELOG.md",
          "product_ids": [
            "8"
          ],
          "url": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/CHANGELOG.md"
        },
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "2.9.2:Security Update:https://github.com/AzureAD/microsoft-authentication-library-for-js#readme",
          "product_ids": [
            "7"
          ],
          "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js#readme"
        },
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "1.12.2:Security Update:https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/identity/azure-identity/CHANGELOG.md",
          "product_ids": [
            "3"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/identity/azure-identity/CHANGELOG.md"
        },
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "4.2.1:Security Update:https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/CHANGELOG.md",
          "product_ids": [
            "2"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/CHANGELOG.md"
        },
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "1.8.0:Security Update:https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/CHANGELOG.md",
          "product_ids": [
            "4"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/CHANGELOG.md"
        },
        {
          "category": "vendor_fix",
          "date": "2024-06-11T07:00:00.000Z",
          "details": "1.16.1:Security Update:https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/CHANGELOG.md",
          "product_ids": [
            "1"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/CHANGELOG.md"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability"
    }
  ]
}