CVE-2024-21381

Summary

CVE-2024-21381 is a newly disclosed vulnerability in Microsoft Azure Active Directory B2C. Attackers can exploit this spoofing issue to trick users into providing sensitive information, such as passwords or multi-factor authentication codes, by manipulating the sign-in page's appearance. The vulnerability arises due to an inadequate input validation mechanism in the affected component, allowing miscreants to craft deceptive sign-in pages. Microsoft has acknowledged the issue and is currently working on a patch to address the vulnerability. Until a fix is available, organizations using Azure AD B2C are recommended to apply additional security measures to safeguard against potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.