What is CVE-2024-29992?

CVE-2024-29992 is a security advisory published by Microsoft Security Response Center (MSRC) with Medium severity. Azure Identity Library for .NET Information Disclosure Vulnerability

Which CVE IDs does CVE-2024-29992 cover?

CVE-2024-29992 covers the following CVE IDs: CVE-2024-29992. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2024-29992?

CVE-2024-29992 has a CVSS v3 base score of 5.5, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2024-29992?

CVE-2024-29992 affects 1 product, including: Azure Identity Library for .NET.

CVE-2024-29992MediumCVSS 5.5

Azure Identity Library for .NET Information Disclosure Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

April 9, 2024

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2024-29992 →

📋 Description

What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is data inside the targeted website like IDs, tokens, nonces, and other sensitive information. Which credential types provided by the Azure Identity client library are affected? The vulnerability exists in the following credential types: DefaultAzureCredential ManagedIdentityCredential

🎯 Affected products1

Azure Identity Library for .NET

✅ Remediation

KBRelease Notes (Security Update) — fixed build 1.11.0

🔗 References (3)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29992
patchhttps://www.nuget.org/packages/Azure.Identity/1.11.0
referencehttps://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/CHANGELOG.md#1110-2024-04-09