Main Vulnerability Database Vulnerabilities #VU81848

Input validation error in Microsoft products - CVE-2023-36415

Published: October 11, 2023

Vulnerability identifier: #VU81848

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36415

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Azure Identity SDK. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Affected software

Azure Identity SDK for Java
Azure Identity SDK for .NET
Azure Identity SDK for Python
Azure Identity SDK for JavaScript

How to mitigate CVE-2023-36415

Install updates from vendor's website.

Azure Identity SDK for Java - update to 1.10.2
Azure Identity SDK for .NET - update to 1.10.2
Azure Identity SDK for Python - update to 1.14.1
Azure Identity SDK for JavaScript - update to 3.3.1

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36415

Related Security Bulletins