Linux Entra Sso
Approved changes feed: RSS · Atom
cpe:2.3:a:siemens:linux-entra-sso:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Siemens (4bd2a91b-02ad-5c3d-b25f-70697e0c9d7f) |
|---|---|
| Product | Linux Entra Sso (1cc6cbb6-b850-56bf-8e09-f1196ee4111c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42177 |
vulnerable | 2026-06-08 08:03:15.971676 |
linux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are granted
MEDIUM (5.3)
linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonline.com/*". Chrome's urlFilter without a | or || anchor is substring-matched against the full request URL. The same applied rule action is modifyHeaders that attaches the Entra ID Primary Refresh Token cookie. The Firefox adapter in platform/firefox/js/platform-firefox.js:53 performs a belt-and-braces startsWith(Platform.SSO_URL) check before injecting the header; the Chrome adapter does not. When the extension holds broad host permissions through the optional_host_permissions: ["https://*/*"] declared in platform/chrome/manifest.json:34, a main-frame navigation to a URL whose path embeds https://login.microsoftonline.com/ causes Chrome to attach the PRT cookie to the request to the attacker-controlled host. This vulnerability is fixed in 1.8.1.
Published: 2026-05-12T17:11:36.050Z
Updated: 2026-05-13T14:37:56.682Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.