CVE-2019-1172 (GCVE-0-2019-1172)
Vulnerability from cvelistv5
Published
2019-08-14 20:55
Modified
2024-08-04 18:06
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Summary
An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token. The security update addresses the vulnerability by correcting how MSA handles cookies.
References
secure@microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172Patch, Vendor Advisory
Impacted products
Vendor Product Version
Microsoft Windows 10 Version 1703 Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1803 Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
    cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:x64:*
    cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:arm64:*
 Create a notification for this product.
   Microsoft Windows Server, version 1803 (Server Core Installation) Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_server_1803:*:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1809 Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
    cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
    cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*
 Create a notification for this product.
   Microsoft Windows Server 2019 Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows Server 2019 (Server Core installation) Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1709 for 32-bit Systems Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1709 Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1903 for 32-bit Systems Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1903 for x64-based Systems Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1903 for ARM64-based Systems Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows Server, version 1903 (Server Core installation) Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1507 Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
    cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
 Create a notification for this product.
   Microsoft Windows 10 Version 1607 Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
    cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
 Create a notification for this product.
   Microsoft Windows Server 2016 Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows Server 2016 (Server Core installation) Version: 10.0.0   < publication
    cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows 8.1 Version: 6.3.0   < publication
    cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x86:*
    cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x64:*
    cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*
 Create a notification for this product.
   Microsoft Windows Server 2012 R2 Version: 6.3.0   < publication
    cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
 Create a notification for this product.
   Microsoft Windows Server 2012 R2 (Server Core installation) Version: 6.3.0   < publication
    cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2019-1172",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-06-18T20:38:26.307862Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-18T20:38:35.038Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:06:32.069Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "32-bit Systems",
                  "x64-based Systems",
               ],
               product: "Windows 10 Version 1703",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
                  "cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:x64:*",
                  "cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:arm64:*",
               ],
               platforms: [
                  "32-bit Systems",
                  "x64-based Systems",
                  "ARM64-based Systems",
               ],
               product: "Windows 10 Version 1803",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_server_1803:*:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Windows Server, version 1803  (Server Core Installation)",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
                  "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
                  "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*",
               ],
               platforms: [
                  "32-bit Systems",
                  "x64-based Systems",
                  "ARM64-based Systems",
               ],
               product: "Windows 10 Version 1809",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Windows Server 2019",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Windows Server 2019 (Server Core installation)",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "32-bit Systems",
               ],
               product: "Windows 10 Version 1709 for 32-bit Systems",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
                  "ARM64-based Systems",
               ],
               product: "Windows 10 Version 1709",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "Unknown",
               ],
               product: "Windows 10 Version 1903 for 32-bit Systems",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "Unknown",
               ],
               product: "Windows 10 Version 1903 for x64-based Systems",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "Unknown",
               ],
               product: "Windows 10 Version 1903 for ARM64-based Systems",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Windows Server, version 1903 (Server Core installation)",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
                  "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*",
               ],
               platforms: [
                  "32-bit Systems",
                  "x64-based Systems",
               ],
               product: "Windows 10 Version 1507",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
                  "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
               ],
               platforms: [
                  "32-bit Systems",
                  "x64-based Systems",
               ],
               product: "Windows 10 Version 1607",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Windows Server 2016",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Windows Server 2016 (Server Core installation)",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "10.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x86:*",
                  "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x64:*",
                  "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*",
               ],
               platforms: [
                  "32-bit Systems",
                  "x64-based Systems",
                  "ARM64-based Systems",
               ],
               product: "Windows 8.1",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "6.3.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Windows Server 2012 R2",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "6.3.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*",
               ],
               platforms: [
                  "x64-based Systems",
               ],
               product: "Windows Server 2012 R2 (Server Core installation)",
               vendor: "Microsoft",
               versions: [
                  {
                     lessThan: "publication",
                     status: "affected",
                     version: "6.3.0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-08-13T07:00:00+00:00",
         descriptions: [
            {
               lang: "en-US",
               value: "An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account.\nTo exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token.\nThe security update addresses the vulnerability by correcting how MSA handles cookies.\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en-US",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Information Disclosure",
                     lang: "en-US",
                     type: "Impact",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-29T16:50:31.359Z",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172",
            },
         ],
         title: "Windows Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1172",
      datePublished: "2019-08-14T20:55:03",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:06:32.069Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"21540673-614A-4D40-8BD7-3F07723803B0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E01A4CCA-4C43-46E0-90E6-3E4DBFBACD64\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AEE2E768-0F45-46E1-B6D7-087917109D98\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83B14968-3985-43C3-ACE5-8307196EFAE3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7CB85C75-4D35-480E-843D-60579EC75FCB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6B8F3DD2-A145-4AF1-8545-CC42892DA3D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3FB5CDAE-C713-4D9D-9D6A-2C2E8924A4BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E93068DB-549B-45AB-8E5C-00EB5D8B5CF8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C6CE5198-C498-4672-AF4C-77AB4BE06C5C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB18C4CE-5917-401E-ACF7-2747084FD36E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CAACE735-003E-4ACB-A82E-C0CF97D7F013\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5B921FDB-8E7D-427E-82BE-4432585080CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB79EE26-FC32-417D-A49C-A1A63165A968\"}]}]}]",
         descriptions: "[{\"lang\": \"en\", \"value\": \"An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account.\\nTo exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token.\\nThe security update addresses the vulnerability by correcting how MSA handles cookies.\\n\"}, {\"lang\": \"es\", \"value\": \"Existe una vulnerabilidad de divulgaci\\u00f3n de informaci\\u00f3n en Microsoft Account (MSA) de Azure Active Directory (AAD), durante la sesi\\u00f3n de una petici\\u00f3n de inicio de sesi\\u00f3n, tambi\\u00e9n se conoce como \\\"Windows Information Disclosure Vulnerability\\\".\"}]",
         id: "CVE-2019-1172",
         lastModified: "2024-11-21T04:36:10.323",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:N/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
         published: "2019-08-14T21:15:16.143",
         references: "[{\"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
         sourceIdentifier: "secure@microsoft.com",
         vulnStatus: "Modified",
         weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2019-1172\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2019-08-14T21:15:16.143\",\"lastModified\":\"2024-11-21T04:36:10.323\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account.\\nTo exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token.\\nThe security update addresses the vulnerability by correcting how MSA handles cookies.\\n\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de divulgación de información en Microsoft Account (MSA) de Azure Active Directory (AAD), durante la sesión de una petición de inicio de sesión, también se conoce como \\\"Windows Information Disclosure Vulnerability\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"21540673-614A-4D40-8BD7-3F07723803B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E01A4CCA-4C43-46E0-90E6-3E4DBFBACD64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEE2E768-0F45-46E1-B6D7-087917109D98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83B14968-3985-43C3-ACE5-8307196EFAE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CB85C75-4D35-480E-843D-60579EC75FCB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B8F3DD2-A145-4AF1-8545-CC42892DA3D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FB5CDAE-C713-4D9D-9D6A-2C2E8924A4BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E93068DB-549B-45AB-8E5C-00EB5D8B5CF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6CE5198-C498-4672-AF4C-77AB4BE06C5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB18C4CE-5917-401E-ACF7-2747084FD36E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAACE735-003E-4ACB-A82E-C0CF97D7F013\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B921FDB-8E7D-427E-82BE-4432585080CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB79EE26-FC32-417D-A49C-A1A63165A968\"}]}]}],\"references\":[{\"url\":\"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T18:06:32.069Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2019-1172\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-18T20:38:26.307862Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-18T20:38:31.615Z\"}}], \"cna\": {\"title\": \"Windows Information Disclosure Vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1703\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"32-bit Systems\", \"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*\", \"cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:x64:*\", \"cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:arm64:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1803\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"32-bit Systems\", \"x64-based Systems\", \"ARM64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_server_1803:*:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows Server, version 1803  (Server Core Installation)\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*\", \"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*\", \"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1809\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"32-bit Systems\", \"x64-based Systems\", \"ARM64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows Server 2019\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows Server 2019 (Server Core installation)\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1709 for 32-bit Systems\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"32-bit Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1709\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\", \"ARM64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1903 for 32-bit Systems\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1903 for x64-based Systems\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1903 for ARM64-based Systems\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows Server, version 1903 (Server Core installation)\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*\", \"cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1507\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"32-bit Systems\", \"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*\", \"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 10 Version 1607\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"32-bit Systems\", \"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows Server 2016\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows Server 2016 (Server Core installation)\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x86:*\", \"cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x64:*\", \"cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows 8.1\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"32-bit Systems\", \"x64-based Systems\", \"ARM64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows Server 2012 R2\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}, {\"cpes\": [\"cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*\"], \"vendor\": \"Microsoft\", \"product\": \"Windows Server 2012 R2 (Server Core installation)\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3.0\", \"lessThan\": \"publication\", \"versionType\": \"custom\"}], \"platforms\": [\"x64-based Systems\"]}], \"datePublic\": \"2019-08-13T07:00:00+00:00\", \"references\": [{\"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1172\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account.\\nTo exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token.\\nThe security update addresses the vulnerability by correcting how MSA handles cookies.\\n\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"Impact\", \"description\": \"Information Disclosure\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2024-05-29T16:50:31.359Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2019-1172\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-04T18:06:32.069Z\", \"dateReserved\": \"2018-11-26T00:00:00\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2019-08-14T20:55:03\", \"assignerShortName\": \"microsoft\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.