CVE-2019-1172
Last modified
CVE-2019-1172 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token. The security update addresses the vulnerability by correcting how MSA handles cookies.. EPSS estimates a 3.99% chance of exploitation in the next 30 days.
Description
An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token. The security update addresses the vulnerability by correcting how MSA handles cookies.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 10 | All versions |
| Microsoft | Windows 10 | 1607 |
| Microsoft | Windows 10 | 1703 |
| Microsoft | Windows 10 | 1709 |
| Microsoft | Windows 10 | 1803 |
| Microsoft | Windows 10 | 1809 |
| Microsoft | Windows 10 | 1903 |
| Microsoft | Windows 8.1 | All versions |
| Microsoft | Windows Rt 8.1 | All versions |
| Microsoft | Windows Server 2012 | All versions |
| Microsoft | Windows Server 2012 | r2 |
| Microsoft | Windows Server 2016 | All versions |
| Microsoft | Windows Server 2016 | 1803 |
| Microsoft | Windows Server 2016 | 1903 |
| Microsoft | Windows Server 2019 | All versions |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1172?
How severe is CVE-2019-1172?
How do I fix CVE-2019-1172?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-11714Necko can access a child on the wrong thread during UDP conn…
- CVE-2019-11715Due to an error while parsing page content, it is possible f…
- CVE-2019-11716Until explicitly accessed by script, window.globalThis is no…
- CVE-2019-11717A vulnerability exists where the caret ("^") character is im…5.3
- CVE-2019-11718Activity Stream can display content from sent from the Snipp…5.3
- CVE-2019-11719When importing a curve25519 private key in PKCS#8format with…
- CVE-2019-11720Some unicode characters are incorrectly treated as whitespac…6.1
- CVE-2019-11721The unicode latin 'kra' character can be used to spoof a sta…6.5
- CVE-2019-11722Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-11723A vulnerability exists during the installation of add-ons wh…7.5
- CVE-2019-11724Application permissions give additional remote troubleshooti…6.1
- CVE-2019-11725When a user navigates to site marked as unsafe by the Safebr…6.5
Are you affected by CVE-2019-1172?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST