Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-27086

Good to know:

icon

Date: April 16, 2024

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application running on a customer Android device can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix. As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.

Language: C#

Severity Score

Related Resources (7)

https://nvd.nist.gov/vuln/detail/CVE-2024-27086
https://www.nuget.org/packages/Microsoft.Identity.Client
https://github.com/AzureAD/microsoft-authentication-library-for-dotnet
https://learn.microsoft.com/en-us/entra/msal/dotnet
https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/security/advisories/GHSA-x674-v45j-fwxw
https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/commit/413e319472ccf48c86647f19fa2aa49ff6038488
https://www.mend.io/vulnerability-database/CVE-2024-27086

Severity Score

Weakness Type (CWE)

Incorrect Authorization

CWE-863

Improper Export of Android Application Components

CWE-926

Top Fix

icon

Upgrade Version

Upgrade to version Microsoft.Identity.Client - 4.59.1,4.60.3

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us