Lucene search

[email protected]CVE-2016-7191

HistorySep 28, 2016 - 8:59 p.m.

CVE-2016-7191

2016-09-2820:59:00

CWE-287

[email protected]

web.nvd.nist.gov

microsoft

azure

active directory

passport

library

vulnerability

node.js

nvd

cve-2016-7191

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.5%

JSON

The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.

Affected configurations

NVD

Node

microsoftazure_active_directory_passportMatch1.0.0

microsoftazure_active_directory_passportMatch1.1.0

microsoftazure_active_directory_passportMatch1.1.1

microsoftazure_active_directory_passportMatch1.2.0

microsoftazure_active_directory_passportMatch1.3.0

microsoftazure_active_directory_passportMatch1.3.1

microsoftazure_active_directory_passportMatch1.3.2

microsoftazure_active_directory_passportMatch1.3.3

microsoftazure_active_directory_passportMatch1.3.4

microsoftazure_active_directory_passportMatch1.3.5

microsoftazure_active_directory_passportMatch1.3.6

microsoftazure_active_directory_passportMatch1.4.0

microsoftazure_active_directory_passportMatch1.4.1

microsoftazure_active_directory_passportMatch1.4.2

microsoftazure_active_directory_passportMatch1.4.3

microsoftazure_active_directory_passportMatch1.4.4

microsoftazure_active_directory_passportMatch1.4.5

microsoftazure_active_directory_passportMatch2.0.0

CPENameOperatorVersion
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.0.0
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.1.0
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.1.1
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.2.0
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.3.0
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.3.1
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.3.2
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.3.3
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.3.4
microsoft:azure_active_directory_passportmicrosoft azure active directory passporteq1.3.5

CPE	Name	Operator	Version
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.0.0
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.1.0
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.1.1
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.2.0
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.3.0
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.3.1
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.3.2
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.3.3
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.3.4
microsoft:azure_active_directory_passport	microsoft azure active directory passport	eq	1.3.5