Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs

By Windows Security
November 17, 2021 in Security

https://windowsbb.com/topic/548419-guidance-for-azure-active-directory-ad-keycredential-property-information-disclosure-in-application-and-service-principal-apis/

Followers 0

Reply to this topic

Recommended Posts

Windows Security

Posted November 17, 2021

Microsoft recently mitigated an information disclosure issue, CVE-2021-42306, to prevent private key data from being stored by some Azure services in the keyCredentialsproperty of an Azure Active Directory (Azure AD) Applicationand/or Service Principal, and prevent reading of private key data previously stored in the keyCredentials property. The keyCredentials property is used to configure an application’s authentication credentials.

View the full article