Vulnerability DatabaseCVE-2023-36414

CVE-2023-36414:
C# vulnerability analysis and mitigation

Overview

Azure Identity SDK Remote Code Execution Vulnerability (CVE-2023-36414) was disclosed in October 2023. This vulnerability affects Microsoft Azure Identity SDK versions up to (excluding) 1.10.2 for .NET platform. The vulnerability has been assigned a CVSS base score of 8.8 HIGH (NVD).

Technical details

The vulnerability is classified as a Command Injection vulnerability (CWE-77) according to Microsoft's assessment. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability can be exploited over the network, requires low attack complexity and low privileges, needs no user interaction, and can result in high impacts to confidentiality, integrity, and availability (MSRC).

Impact

Successful exploitation of this vulnerability could allow an attacker to execute remote code on affected systems. The high CVSS score of 8.8 indicates severe potential impacts on system confidentiality, integrity, and availability (Rapid7).

Mitigation and workarounds

Microsoft has released version 1.10.2 of the Azure Identity SDK for .NET to address this vulnerability. Users are strongly recommended to upgrade to this version or later to mitigate the risk (Tech Community).