Search criteria

22 vulnerabilities found for Azure Stack Hub by Microsoft

CVE-2025-53765 (GCVE-0-2025-53765)

Vulnerability from cvelistv5 – Published: 2025-08-12 17:10 – Updated: 2025-11-10 00:12
VLAI?
Summary
Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.
Severity ?
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CWE
  • CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 102.10.2.11 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-12T19:58:40.510895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T19:58:51.135Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "102.10.2.11",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "102.10.2.11",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2025-08-12T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T00:12:41.628Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Information Disclosure Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53765"
        }
      ],
      "title": "Azure Stack Hub Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2025-53765",
    "datePublished": "2025-08-12T17:10:37.127Z",
    "dateReserved": "2025-07-09T13:25:25.500Z",
    "dateUpdated": "2025-11-10T00:12:41.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38220 (GCVE-0-2024-38220)

Vulnerability from cvelistv5 – Published: 2024-09-10 16:53 – Updated: 2024-12-31 23:02
VLAI?
Summary
Azure Stack Hub Elevation of Privilege Vulnerability
Severity ?
9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2406.1.15 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38220",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T19:03:22.950049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T19:03:30.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2406.1.15",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2406.1.15",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-09-10T07:00:00+00:00",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-31T23:02:48.728Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38220"
        }
      ],
      "title": "Azure Stack Hub Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-38220",
    "datePublished": "2024-09-10T16:53:42.438Z",
    "dateReserved": "2024-06-11T22:36:08.224Z",
    "dateUpdated": "2024-12-31T23:02:48.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38216 (GCVE-0-2024-38216)

Vulnerability from cvelistv5 – Published: 2024-09-10 16:53 – Updated: 2024-12-31 23:02
VLAI?
Summary
Azure Stack Hub Elevation of Privilege Vulnerability
Severity ?
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L/E:U/RL:O/RC:C
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2406.1.15 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T19:04:04.555603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T19:04:16.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2406.1.15",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2406.1.15",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-09-10T07:00:00+00:00",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-31T23:02:48.153Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38216"
        }
      ],
      "title": "Azure Stack Hub Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-38216",
    "datePublished": "2024-09-10T16:53:41.902Z",
    "dateReserved": "2024-06-11T22:36:08.224Z",
    "dateUpdated": "2024-12-31T23:02:48.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38201 (GCVE-0-2024-38201)

Vulnerability from cvelistv5 – Published: 2024-08-13 17:29 – Updated: 2025-07-10 16:33
VLAI?
Summary
Azure Stack Hub Elevation of Privilege Vulnerability
Severity ?
7 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2311.1.22 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-13T17:56:41.394011Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T18:11:08.821Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2311.1.22",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2311.1.22",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-08-13T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T16:33:07.749Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38201"
        }
      ],
      "title": "Azure Stack Hub Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-38201",
    "datePublished": "2024-08-13T17:29:55.880Z",
    "dateReserved": "2024-06-11T22:36:08.221Z",
    "dateUpdated": "2025-07-10T16:33:07.749Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38108 (GCVE-0-2024-38108)

Vulnerability from cvelistv5 – Published: 2024-08-13 17:29 – Updated: 2025-07-10 16:32
VLAI?
Summary
Azure Stack Hub Spoofing Vulnerability
Severity ?
9.3 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2311.1.22 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38108",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T20:20:02.361036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-14T20:20:15.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2311.1.22",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2311.1.22",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-08-13T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T16:32:57.038Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38108"
        }
      ],
      "title": "Azure Stack Hub Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-38108",
    "datePublished": "2024-08-13T17:29:45.168Z",
    "dateReserved": "2024-06-11T22:36:08.188Z",
    "dateUpdated": "2025-07-10T16:32:57.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-20679 (GCVE-0-2024-20679)

Vulnerability from cvelistv5 – Published: 2024-02-13 18:02 – Updated: 2025-05-03 01:37
VLAI?
Summary
Azure Stack Hub Spoofing Vulnerability
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2311.1.22 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-14T16:32:30.868468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-25T19:39:27.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:59:42.380Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure Stack Hub Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20679"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2311.1.22",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2311.1.22",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-02-13T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-03T01:37:24.701Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20679"
        }
      ],
      "title": "Azure Stack Hub Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-20679",
    "datePublished": "2024-02-13T18:02:26.447Z",
    "dateReserved": "2023-11-28T22:58:12.117Z",
    "dateUpdated": "2025-05-03T01:37:24.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-29149 (GCVE-0-2022-29149)

Vulnerability from cvelistv5 – Published: 2022-06-15 21:51 – Updated: 2025-01-02 19:03
VLAI?
Summary
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CWE
  • Elevation of Privilege
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.33, 3.0.0.7 (custom)
Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.27 and LAD v3.0.137 (custom)
Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.9-1 (custom)
Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) 2022 Affected: 10.22.0 , < 10.22.1024.0 (custom)
Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) 2019 Affected: 10.19.0 , < 10.19.1152.0 (custom)
Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) 2016 Affected: 7.6.0 , < 7.6.1108.0 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:10:59.490Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29149"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.27 and LAD v3.0.137",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.9-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM) 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.22.1024.0",
              "status": "affected",
              "version": "10.22.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM) 2019",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.19.1152.0",
              "status": "affected",
              "version": "10.19.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM) 2016",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.6.1108.0",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "LAD v4.0.27 and LAD v3.0.137",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMI Version 1.6.9-1",
                  "versionStartIncluding": "16.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "10.22.1024.0",
                  "versionStartIncluding": "10.22.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "10.19.1152.0",
                  "versionStartIncluding": "10.19.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.1108.0",
                  "versionStartIncluding": "7.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2022-06-14T07:00:00+00:00",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-02T19:03:13.161Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149"
        }
      ],
      "title": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2022-29149",
    "datePublished": "2022-06-15T21:51:17",
    "dateReserved": "2022-04-12T00:00:00",
    "dateUpdated": "2025-01-02T19:03:13.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-38649 (GCVE-0-2021-38649)

Vulnerability from cvelistv5 – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • Elevation of Privilege
Assigner
References
Impacted products
Vendor Product Version
Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) Affected: 1.0.0 , < OMI version: 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 (custom)
    cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.13 and LAD v3.0.135 (custom)
    cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
    cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < Monitor, Update and Config Mgmnt 1.14.01 (custom)
Affected: 1.0.0 , < 3.1.135 (custom)
    cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:19.019Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38649",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T18:09:12.228704Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:32.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-38649 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.8-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI version: 1.6.8-1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.135",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-14T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:37:21.066Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
        }
      ],
      "title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2021-38649",
    "datePublished": "2021-09-15T11:24:09.000Z",
    "dateReserved": "2021-08-13T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:32.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-38648 (GCVE-0-2021-38648)

Vulnerability from cvelistv5 – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • Elevation of Privilege
Assigner
References
Impacted products
Vendor Product Version
Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) Affected: 1.0.0 , < OMI version: 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 (custom)
    cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.13 and LAD v3.0.135 (custom)
    cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
    cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < Monitor, Update and Config Mgmnt 1.14.01 (custom)
Affected: 1.0.0 , < 3.1.135 (custom)
    cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:18.994Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38648",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T18:10:24.645431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:32.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-38648 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.8-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI version: 1.6.8-1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.135",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-14T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:37:20.542Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
        }
      ],
      "title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2021-38648",
    "datePublished": "2021-09-15T11:24:08.000Z",
    "dateReserved": "2021-08-13T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:32.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-38647 (GCVE-0-2021-38647)

Vulnerability from cvelistv5 – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Remote Code Execution Vulnerability
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • Remote Code Execution
Assigner
References
Impacted products
Vendor Product Version
Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) Affected: 1.0.0 , < OMI version: 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 (custom)
    cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.13 and LAD v3.0.135 (custom)
    cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
    cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < Monitor, Update and Config Mgmnt 1.14.01 (custom)
Affected: 1.0.0 , < 3.1.135 (custom)
    cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:18.937Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38647",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T14:45:47.017000Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:33.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-38647 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.8-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI version: 1.6.8-1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.135",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-14T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:37:20.007Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
        }
      ],
      "title": "Open Management Infrastructure Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2021-38647",
    "datePublished": "2021-09-15T11:24:07.000Z",
    "dateReserved": "2021-08-13T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:33.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-38645 (GCVE-0-2021-38645)

Vulnerability from cvelistv5 – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • Elevation of Privilege
Assigner
References
Impacted products
Vendor Product Version
Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) Affected: 1.0.0 , < OMI version: 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 (custom)
    cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.13 and LAD v3.0.135 (custom)
    cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
    cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < Monitor, Update and Config Mgmnt 1.14.01 (custom)
Affected: 1.0.0 , < 3.1.135 (custom)
    cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:18.959Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38645",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T15:43:58.641391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38645"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:33.443Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38645"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-38645 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.8-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI version: 1.6.8-1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.135",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-14T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:37:19.506Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645"
        }
      ],
      "title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2021-38645",
    "datePublished": "2021-09-15T11:24:05.000Z",
    "dateReserved": "2021-08-13T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:33.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-53765 (GCVE-0-2025-53765)

Vulnerability from nvd – Published: 2025-08-12 17:10 – Updated: 2025-11-10 00:12
VLAI?
Summary
Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.
Severity ?
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CWE
  • CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 102.10.2.11 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-12T19:58:40.510895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T19:58:51.135Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "102.10.2.11",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "102.10.2.11",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2025-08-12T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-359",
              "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T00:12:41.628Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Information Disclosure Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53765"
        }
      ],
      "title": "Azure Stack Hub Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2025-53765",
    "datePublished": "2025-08-12T17:10:37.127Z",
    "dateReserved": "2025-07-09T13:25:25.500Z",
    "dateUpdated": "2025-11-10T00:12:41.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38220 (GCVE-0-2024-38220)

Vulnerability from nvd – Published: 2024-09-10 16:53 – Updated: 2024-12-31 23:02
VLAI?
Summary
Azure Stack Hub Elevation of Privilege Vulnerability
Severity ?
9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2406.1.15 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38220",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T19:03:22.950049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T19:03:30.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2406.1.15",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2406.1.15",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-09-10T07:00:00+00:00",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-31T23:02:48.728Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38220"
        }
      ],
      "title": "Azure Stack Hub Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-38220",
    "datePublished": "2024-09-10T16:53:42.438Z",
    "dateReserved": "2024-06-11T22:36:08.224Z",
    "dateUpdated": "2024-12-31T23:02:48.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38216 (GCVE-0-2024-38216)

Vulnerability from nvd – Published: 2024-09-10 16:53 – Updated: 2024-12-31 23:02
VLAI?
Summary
Azure Stack Hub Elevation of Privilege Vulnerability
Severity ?
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L/E:U/RL:O/RC:C
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2406.1.15 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T19:04:04.555603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T19:04:16.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2406.1.15",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2406.1.15",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-09-10T07:00:00+00:00",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-31T23:02:48.153Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38216"
        }
      ],
      "title": "Azure Stack Hub Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-38216",
    "datePublished": "2024-09-10T16:53:41.902Z",
    "dateReserved": "2024-06-11T22:36:08.224Z",
    "dateUpdated": "2024-12-31T23:02:48.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38201 (GCVE-0-2024-38201)

Vulnerability from nvd – Published: 2024-08-13 17:29 – Updated: 2025-07-10 16:33
VLAI?
Summary
Azure Stack Hub Elevation of Privilege Vulnerability
Severity ?
7 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2311.1.22 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-13T17:56:41.394011Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T18:11:08.821Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2311.1.22",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2311.1.22",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-08-13T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T16:33:07.749Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38201"
        }
      ],
      "title": "Azure Stack Hub Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-38201",
    "datePublished": "2024-08-13T17:29:55.880Z",
    "dateReserved": "2024-06-11T22:36:08.221Z",
    "dateUpdated": "2025-07-10T16:33:07.749Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38108 (GCVE-0-2024-38108)

Vulnerability from nvd – Published: 2024-08-13 17:29 – Updated: 2025-07-10 16:32
VLAI?
Summary
Azure Stack Hub Spoofing Vulnerability
Severity ?
9.3 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2311.1.22 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38108",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T20:20:02.361036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-14T20:20:15.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2311.1.22",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2311.1.22",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-08-13T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T16:32:57.038Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38108"
        }
      ],
      "title": "Azure Stack Hub Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-38108",
    "datePublished": "2024-08-13T17:29:45.168Z",
    "dateReserved": "2024-06-11T22:36:08.188Z",
    "dateUpdated": "2025-07-10T16:32:57.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-20679 (GCVE-0-2024-20679)

Vulnerability from nvd – Published: 2024-02-13 18:02 – Updated: 2025-05-03 01:37
VLAI?
Summary
Azure Stack Hub Spoofing Vulnerability
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Stack Hub Affected: 1.0.0 , < 1.2311.1.22 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-14T16:32:30.868468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-25T19:39:27.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:59:42.380Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure Stack Hub Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20679"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.2311.1.22",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2311.1.22",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-02-13T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Stack Hub Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-03T01:37:24.701Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Stack Hub Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20679"
        }
      ],
      "title": "Azure Stack Hub Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-20679",
    "datePublished": "2024-02-13T18:02:26.447Z",
    "dateReserved": "2023-11-28T22:58:12.117Z",
    "dateUpdated": "2025-05-03T01:37:24.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-29149 (GCVE-0-2022-29149)

Vulnerability from nvd – Published: 2022-06-15 21:51 – Updated: 2025-01-02 19:03
VLAI?
Summary
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CWE
  • Elevation of Privilege
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.33, 3.0.0.7 (custom)
Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.27 and LAD v3.0.137 (custom)
Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < OMS Agent for Linux GA v1.14.13 (custom)
Create a notification for this product.
    Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.9-1 (custom)
Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) 2022 Affected: 10.22.0 , < 10.22.1024.0 (custom)
Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) 2019 Affected: 10.19.0 , < 10.19.1152.0 (custom)
Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) 2016 Affected: 7.6.0 , < 7.6.1108.0 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:10:59.490Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29149"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.27 and LAD v3.0.137",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.14.13",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.9-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM) 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.22.1024.0",
              "status": "affected",
              "version": "10.22.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM) 2019",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.19.1152.0",
              "status": "affected",
              "version": "10.19.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM) 2016",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.6.1108.0",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "LAD v4.0.27 and LAD v3.0.137",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "OMI Version 1.6.9-1",
                  "versionStartIncluding": "16.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "10.22.1024.0",
                  "versionStartIncluding": "10.22.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "10.19.1152.0",
                  "versionStartIncluding": "10.19.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.1108.0",
                  "versionStartIncluding": "7.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2022-06-14T07:00:00+00:00",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-02T19:03:13.161Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149"
        }
      ],
      "title": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2022-29149",
    "datePublished": "2022-06-15T21:51:17",
    "dateReserved": "2022-04-12T00:00:00",
    "dateUpdated": "2025-01-02T19:03:13.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-38649 (GCVE-0-2021-38649)

Vulnerability from nvd – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • Elevation of Privilege
Assigner
References
Impacted products
Vendor Product Version
Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) Affected: 1.0.0 , < OMI version: 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 (custom)
    cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.13 and LAD v3.0.135 (custom)
    cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
    cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < Monitor, Update and Config Mgmnt 1.14.01 (custom)
Affected: 1.0.0 , < 3.1.135 (custom)
    cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:19.019Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38649",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T18:09:12.228704Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:32.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-38649 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.8-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI version: 1.6.8-1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.135",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-14T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:37:21.066Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
        }
      ],
      "title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2021-38649",
    "datePublished": "2021-09-15T11:24:09.000Z",
    "dateReserved": "2021-08-13T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:32.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-38648 (GCVE-0-2021-38648)

Vulnerability from nvd – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • Elevation of Privilege
Assigner
References
Impacted products
Vendor Product Version
Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) Affected: 1.0.0 , < OMI version: 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 (custom)
    cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.13 and LAD v3.0.135 (custom)
    cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
    cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < Monitor, Update and Config Mgmnt 1.14.01 (custom)
Affected: 1.0.0 , < 3.1.135 (custom)
    cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:18.994Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38648",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T18:10:24.645431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:32.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-38648 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.8-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI version: 1.6.8-1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.135",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-14T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:37:20.542Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
        }
      ],
      "title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2021-38648",
    "datePublished": "2021-09-15T11:24:08.000Z",
    "dateReserved": "2021-08-13T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:32.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-38647 (GCVE-0-2021-38647)

Vulnerability from nvd – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Remote Code Execution Vulnerability
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • Remote Code Execution
Assigner
References
Impacted products
Vendor Product Version
Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) Affected: 1.0.0 , < OMI version: 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 (custom)
    cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.13 and LAD v3.0.135 (custom)
    cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
    cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < Monitor, Update and Config Mgmnt 1.14.01 (custom)
Affected: 1.0.0 , < 3.1.135 (custom)
    cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:18.937Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38647",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T14:45:47.017000Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:33.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-38647 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.8-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI version: 1.6.8-1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.135",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-14T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:37:20.007Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
        }
      ],
      "title": "Open Management Infrastructure Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2021-38647",
    "datePublished": "2021-09-15T11:24:07.000Z",
    "dateReserved": "2021-08-13T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:33.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-38645 (GCVE-0-2021-38645)

Vulnerability from nvd – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CWE
  • Elevation of Privilege
Assigner
References
Impacted products
Vendor Product Version
Microsoft Open Management Infrastructure Affected: 16.0 , < OMI Version 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft System Center Operations Manager (SCOM) Affected: 1.0.0 , < OMI version: 1.6.8-1 (custom)
    cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation State Configuration, DSC Extension Affected: 2.0.0 , < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 (custom)
    cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Automation Update Management Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Log Analytics Agent Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Diagnostics (LAD) Affected: 3.0.0 , < LAD v4.0.13 and LAD v3.0.135 (custom)
    cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Container Monitoring Solution Affected: 1.0.0 , < publication (custom)
    cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Security Center Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Sentinel Affected: 1.0.0 , < OMS Agent for Linux GA v1.13.40-0 (custom)
    cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
 Create a notification for this product.
    Microsoft Azure Stack Hub Affected: 1.0.0 , < Monitor, Update and Config Mgmnt 1.14.01 (custom)
Affected: 1.0.0 , < 3.1.135 (custom)
    cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:18.959Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38645",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T15:43:58.641391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38645"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:33.443Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38645"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-38645 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Open Management Infrastructure",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI Version 1.6.8-1",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "System Center Operations Manager (SCOM)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMI version: 1.6.8-1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation State Configuration, DSC Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Automation Update Management",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Log Analytics Agent",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Diagnostics (LAD)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Container Monitoring Solution",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Security Center",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Sentinel",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
          ],
          "platforms": [
            "Unknown"
          ],
          "product": "Azure Stack Hub",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.135",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-14T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-28T19:37:19.506Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645"
        }
      ],
      "title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2021-38645",
    "datePublished": "2021-09-15T11:24:05.000Z",
    "dateReserved": "2021-08-13T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:33.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}