CVE-2019-1172: microsoft windows_10

Vulnerability summary

CVE-2019-1172 is a medium (CVSS 4.3) vulnerability in microsoft windows_10. EPSS estimates a 3.99% chance of exploitation in the next 30 days, higher than 90.4% of scored vulnerabilities.

Timeline

1. 14-08-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token. The security update addresses the vulnerability by correcting how MSA handles cookies.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.