60
CVE-2019-1172
- CVSS 3.1
- 4.3 medium
- EPSS
- 4%p90
- Published
- ·
- Modified
Description · NVD
An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token. The security update addresses the vulnerability by correcting how MSA handles cookies.
- Vendors
- microsoft
- Products
- windows 10, windows 8.1, windows rt 8.1, windows server 2012, windows server 2016, windows server 2019
- Weakness
- CWE-200
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N