CVE-2023-36415: Azure Identity SDK Remote Code Execution Vulnerability

According to the CVSS metric, the attack vector is network (AV:N), and privilege required is low (PR:L). What is the target used in the context of the remote code execution?

The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server’s account through a network call.

The privilege requirement is low because the attacker needs to be authenticated as a normal user.