Input validation error in Azure Identity SDK for .NET - CVE-2023-36414

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU81847

Input validation error in Azure Identity SDK for .NET - CVE-2023-36414

Published: October 11, 2023


Vulnerability identifier: #VU81847
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-36414
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Azure Identity SDK. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.


Affected software

Azure Identity SDK for .NET
Robotic Process Automation for Cloud Pak
IBM Robotic Process Automation

How to mitigate CVE-2023-36414

Install updates from vendor's website.

Azure Identity SDK for .NET - update to 1.10.2
IBM Robotic Process Automation - addressed in versions 21.0.7.12, 23.0.12
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.12, 23.0.12

External References

Related Security Bulletins