CVE-2019-1172

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into browsing to a specially crafted website, allowing the attacker to steal the user's token. The security update addresses the vulnerability by correcting how MSA handles cookies.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117206.1Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This a CVE-2019-117216.5The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks a CVE-2019-117237.5A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. Thi CVE-2019-117246.1Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redi CVE-2019-117256.5When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but res CVE-2019-117275.3A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when CVE-2019-117284.7The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a us CVE-2019-117297.5Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into mem CVE-2019-11737.0An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successf CVE-2019-117306.5A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same direc CVE-2019-117339.8When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It w CVE-2019-117349.8Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory cor