CVE-2024-43477

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-43477
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43477 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:*
History

29 Jan 2025, 16:30

Type Values Removed Values Added
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43477 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43477 - Vendor Advisory
CWE NVD-CWE-Other
CPE cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:*
First Time Microsoft entra Id
Microsoft

10 Sep 2024, 18:15

Type Values Removed Values Added
Summary (en) Improper access control in Decentralized Identity Services allows an unathenticated attacker to disable Verifiable ID's on another tenant. (en) Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant.

23 Aug 2024, 16:18

Type Values Removed Values Added
Summary
  • (es) Un control de acceso inadecuado en Decentralized Identity Services permite que un atacante no autenticado deshabilite las identificaciones verificables en otro inquilino.

23 Aug 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-23 02:15

Updated : 2025-01-29 16:30

NVD link : CVE-2024-43477

Mitre link : CVE-2024-43477

CVE.ORG link : CVE-2024-43477

JSON object : View

Products Affected

microsoft

  • entra_id
CWE
CWE-284

Improper Access Control

NVD-CWE-Other