AVID-2026-R1254

Description

Azure Identity SDK Remote Code Execution Vulnerability (CVE-2023-36414)

Details

Azure Identity SDK Remote Code Execution Vulnerability

Reason for inclusion in AVID: CVE-2023-36414 is a remote code execution vulnerability in the Azure Identity SDK for .NET. This SDK is a common dependency in AI deployment stacks on Azure (authentication/authorization for AI services, storage, compute). As a vulnerability in a library used to build/run AI systems, it represents a software supply-chain risk for general-purpose AI workflows. It has clear security impact (RCE) with public references (NVD, MSRC). Therefore it should be kept for AVID curation.

References

Affected or Relevant Artifacts

Developer: Microsoft
Deployer: Microsoft
Artifact Details:

Type	Name
System	Azure Identity SDK for .NET

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:W/RC:C
Base Score	8.8
Base Severity	🔴 High

CWE

ID	Description
CWE-77	CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-10-10
Version: 0.3.3
AVID Entry