Search criteria
48 vulnerabilities found for system_center_operations_manager by microsoft
FKIE_CVE-2025-27743
Vulnerability from fkie_nvd - Published: 2025-04-08 18:16 - Updated: 2025-07-10 15:13
Severity ?
Summary
Untrusted search path in System Center allows an authorized attacker to elevate privileges locally.
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27743 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "AFF85EC5-092E-439F-9336-087A8080EF29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "88CFD239-E870-46DB-B77A-EFBC46A09BE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:2025:-:*:*:*:*:*:*",
"matchCriteriaId": "50724A4D-AD79-41AB-8FE9-21091D0D5CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "0BFD64D6-E8BB-4606-8D4C-EAE586CAD791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "ABD632BE-513E-4581-9C8C-3A13DA1ADF1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2025:-:*:*:*:*:*:*",
"matchCriteriaId": "0507AA0D-CBD5-400D-B24C-0549778F6029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "B5E458FC-BB19-4AC4-B94D-A5A9F25D723F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "25E6F797-067D-4372-B3BC-3F77FD2986FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:2025:-:*:*:*:*:*:*",
"matchCriteriaId": "1A19BFD4-DAD8-4B0E-AF63-78590ACEC48E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "17E46BD1-95BB-490C-A1F7-300DF80B119D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "E9F69A12-E14C-4111-9B6F-D319128D081F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:2025:-:*:*:*:*:*:*",
"matchCriteriaId": "C8B3216B-3457-4EDA-9C2D-B52CCEB2E15A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "A5F1977C-D2A3-4CD9-A2EB-62F0C56B8F6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "51480EB4-2477-4D86-9724-4CA5FEFC76FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:2025:-:*:*:*:*:*:*",
"matchCriteriaId": "BD13CFAE-ED86-4DFB-B90E-5FF2B162BB4A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path in System Center allows an authorized attacker to elevate privileges locally."
},
{
"lang": "es",
"value": "La ruta de b\u00fasqueda no confiable en System Center permite que un atacante autorizado eleve privilegios localmente."
}
],
"id": "CVE-2025-27743",
"lastModified": "2025-07-10T15:13:40.693",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Primary"
}
]
},
"published": "2025-04-08T18:16:03.260",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27743"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-426"
}
],
"source": "secure@microsoft.com",
"type": "Primary"
}
]
}
FKIE_CVE-2024-21334
Vulnerability from fkie_nvd - Published: 2024-03-12 17:15 - Updated: 2024-11-29 20:52
Severity ?
Summary
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | open_management_infrastructure | * | |
| microsoft | system_center_operations_manager | 2019 | |
| microsoft | system_center_operations_manager | 2022 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45DDA86F-4F30-4507-8E8B-9974AC049B9D",
"versionEndExcluding": "1.8.1-0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "0BFD64D6-E8BB-4606-8D4C-EAE586CAD791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "ABD632BE-513E-4581-9C8C-3A13DA1ADF1F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability"
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de infraestructura de gesti\u00f3n abierta (OMI)"
}
],
"id": "CVE-2024-21334",
"lastModified": "2024-11-29T20:52:35.697",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Primary"
}
]
},
"published": "2024-03-12T17:15:49.310",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2024-21330
Vulnerability from fkie_nvd - Published: 2024-03-12 17:15 - Updated: 2024-12-27 17:07
Severity ?
Summary
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_automation:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D341E199-250C-47C7-ABE8-39973A5C63E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23A8B342-E863-4C71-9CE1-FB325FF34829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1626DA-5B19-4291-B840-633EF458984C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B80F8C3B-BEF9-43D5-9455-6C6F608CF519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68A461E8-C834-4F97-98E3-516A191A3BAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDAE892B-324C-45E3-BFA0-C2B7B6939F54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:operations_management_suite_agent_for_linux:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1B6D6F4-F48C-482B-B54B-6962D6D506A9",
"versionEndExcluding": "1.8.1-0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "0BFD64D6-E8BB-4606-8D4C-EAE586CAD791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "ABD632BE-513E-4581-9C8C-3A13DA1ADF1F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
},
{
"lang": "es",
"value": "Infraestructura de gesti\u00f3n abierta (OMI) Vulnerabilidad de elevaci\u00f3n de privilegios"
}
],
"id": "CVE-2024-21330",
"lastModified": "2024-12-27T17:07:41.530",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Primary"
}
]
},
"published": "2024-03-12T17:15:49.143",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2023-36043
Vulnerability from fkie_nvd - Published: 2023-11-14 18:15 - Updated: 2024-11-21 08:09
Severity ?
6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
Open Management Infrastructure Information Disclosure Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36043 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36043 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | system_center_operations_manager | 2016 | |
| microsoft | system_center_operations_manager | 2019 | |
| microsoft | system_center_operations_manager | 2022 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:*",
"matchCriteriaId": "480C08E8-C868-455C-97FB-68311B523F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "0BFD64D6-E8BB-4606-8D4C-EAE586CAD791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "ABD632BE-513E-4581-9C8C-3A13DA1ADF1F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open Management Infrastructure Information Disclosure Vulnerability"
},
{
"lang": "es",
"value": "Vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en Open Management Infrastructure."
}
],
"id": "CVE-2023-36043",
"lastModified": "2024-11-21T08:09:13.980",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 4.0,
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-14T18:15:34.890",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36043"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36043"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-668"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-33640
Vulnerability from fkie_nvd - Published: 2022-08-09 20:15 - Updated: 2025-06-05 19:15
Severity ?
Summary
System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | open_management_infrastructure | * | |
| microsoft | system_center_operations_manager | 2016 | |
| microsoft | system_center_operations_manager | 2019 | |
| microsoft | system_center_operations_manager | 2022 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B0E2FA72-D8F0-4DE6-84FB-89E1AC0147D9",
"versionEndExcluding": "1.6.10-2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:*",
"matchCriteriaId": "480C08E8-C868-455C-97FB-68311B523F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "0BFD64D6-E8BB-4606-8D4C-EAE586CAD791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "ABD632BE-513E-4581-9C8C-3A13DA1ADF1F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
},
{
"lang": "es",
"value": "Una vulnerabilidad de Elevaci\u00f3n de Privilegios en System Center Operations Manager: Open Management Infrastructure (OMI)"
}
],
"id": "CVE-2022-33640",
"lastModified": "2025-06-05T19:15:24.473",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
}
]
},
"published": "2022-08-09T20:15:10.097",
"references": [
{
"source": "secure@microsoft.com",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33640"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33640"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2022-29149
Vulnerability from fkie_nvd - Published: 2022-06-15 22:15 - Updated: 2025-01-02 19:16
Severity ?
Summary
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC617A6-F1BC-44DE-A9BB-BECF2E788B0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23A8B342-E863-4C71-9CE1-FB325FF34829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9FDF9306-CC67-4A45-8FB1-AA18946FCD8D",
"versionEndExcluding": "3.0.137",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5228AB79-AFF1-4B2D-BB60-62D180F6D83B",
"versionEndExcluding": "4.0.27",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0561E514-5A02-4850-8D52-65A8B4B642B2",
"versionEndExcluding": "1.14.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CC02B82A-903B-467E-92D7-21573ED88FF8",
"versionEndExcluding": "1.14.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
"matchCriteriaId": "51886A45-029F-40A8-929B-49552FEB5298",
"versionEndExcluding": "1.14.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68A461E8-C834-4F97-98E3-516A191A3BAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDAE892B-324C-45E3-BFA0-C2B7B6939F54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73FDDB2A-BA93-47AB-82A3-314638D8A660",
"versionEndExcluding": "1.6.9-1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:*",
"matchCriteriaId": "480C08E8-C868-455C-97FB-68311B523F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "0BFD64D6-E8BB-4606-8D4C-EAE586CAD791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2022:-:*:*:*:*:*:*",
"matchCriteriaId": "ABD632BE-513E-4581-9C8C-3A13DA1ADF1F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
},
{
"lang": "es",
"value": "Una Vulnerabilidad de Elevaci\u00f3n de Privilegios en Azure Open Management Infrastructure (OMI)"
}
],
"id": "CVE-2022-29149",
"lastModified": "2025-01-02T19:16:13.227",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
}
]
},
"published": "2022-06-15T22:15:13.220",
"references": [
{
"source": "secure@microsoft.com",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29149"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-41352
Vulnerability from fkie_nvd - Published: 2021-10-13 01:15 - Updated: 2024-11-21 06:26
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
SCOM Information Disclosure Vulnerability
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | system_center_operations_manager | 2012 | |
| microsoft | system_center_operations_manager | 2016 | |
| microsoft | system_center_operations_manager | 2019 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2012:r2:*:*:*:*:*:*",
"matchCriteriaId": "62EBE19E-7E85-4522-82BF-49E33C47A493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:*",
"matchCriteriaId": "480C08E8-C868-455C-97FB-68311B523F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "0BFD64D6-E8BB-4606-8D4C-EAE586CAD791",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SCOM Information Disclosure Vulnerability"
},
{
"lang": "es",
"value": "Una vulnerabilidad de Divulgaci\u00f3n de Informaci\u00f3n en SCOM"
}
],
"id": "CVE-2021-41352",
"lastModified": "2024-11-21T06:26:07.223",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2021-10-13T01:15:13.683",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41352"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41352"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-38648
Vulnerability from fkie_nvd - Published: 2021-09-15 12:15 - Updated: 2025-10-30 19:13
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html | Exploit, Third Party Advisory, VDB Entry | |
| secure@microsoft.com | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648 | Patch, Vendor Advisory | |
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648 | US Government Resource |
Impacted products
{
"cisaActionDue": "2021-11-17",
"cisaExploitAdd": "2021-11-03",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC617A6-F1BC-44DE-A9BB-BECF2E788B0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23A8B342-E863-4C71-9CE1-FB325FF34829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_diagnostics_\\(lad\\):-:*:*:*:*:*:*:*",
"matchCriteriaId": "37AC51D6-F6F3-45D8-91E7-6EDD01C0273E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8477F336-71BB-4C49-A4EB-E1BC1EFF2F49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1626DA-5B19-4291-B840-633EF458984C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B80F8C3B-BEF9-43D5-9455-6C6F608CF519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B457DA44-AD83-4E5C-B180-8A227462EC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68A461E8-C834-4F97-98E3-516A191A3BAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDAE892B-324C-45E3-BFA0-C2B7B6939F54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79983385-D5FE-4F76-924C-A2AA7E5BAAE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
},
{
"lang": "es",
"value": "Una Vulnerabilidad de Elevaci\u00f3n de Privilegios en Open Management Infrastructure. Este ID CVE es \u00fanico desde CVE-2021-38645, CVE-2021-38649"
}
],
"id": "CVE-2021-38648",
"lastModified": "2025-10-30T19:13:49.427",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2021-09-15T12:15:15.147",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
},
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-38649
Vulnerability from fkie_nvd - Published: 2021-09-15 12:15 - Updated: 2025-10-30 19:16
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
References
Impacted products
{
"cisaActionDue": "2021-11-17",
"cisaExploitAdd": "2021-11-03",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC617A6-F1BC-44DE-A9BB-BECF2E788B0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23A8B342-E863-4C71-9CE1-FB325FF34829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_diagnostics_\\(lad\\):-:*:*:*:*:*:*:*",
"matchCriteriaId": "37AC51D6-F6F3-45D8-91E7-6EDD01C0273E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8477F336-71BB-4C49-A4EB-E1BC1EFF2F49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1626DA-5B19-4291-B840-633EF458984C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B80F8C3B-BEF9-43D5-9455-6C6F608CF519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B457DA44-AD83-4E5C-B180-8A227462EC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68A461E8-C834-4F97-98E3-516A191A3BAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDAE892B-324C-45E3-BFA0-C2B7B6939F54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79983385-D5FE-4F76-924C-A2AA7E5BAAE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
},
{
"lang": "es",
"value": "Una Vulnerabilidad de Elevaci\u00f3n de Privilegios en Open Management Infrastructure. Este CVE ID es diferente de CVE-2021-38645, CVE-2021-38648"
}
],
"id": "CVE-2021-38649",
"lastModified": "2025-10-30T19:16:45.507",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2021-09-15T12:15:15.203",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-38647
Vulnerability from fkie_nvd - Published: 2021-09-15 12:15 - Updated: 2025-10-30 19:13
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Open Management Infrastructure Remote Code Execution Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html | Exploit, Third Party Advisory, VDB Entry | |
| secure@microsoft.com | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647 | Patch, Vendor Advisory | |
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647 | US Government Resource |
Impacted products
{
"cisaActionDue": "2021-11-17",
"cisaExploitAdd": "2021-11-03",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC617A6-F1BC-44DE-A9BB-BECF2E788B0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23A8B342-E863-4C71-9CE1-FB325FF34829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_diagnostics_\\(lad\\):-:*:*:*:*:*:*:*",
"matchCriteriaId": "37AC51D6-F6F3-45D8-91E7-6EDD01C0273E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8477F336-71BB-4C49-A4EB-E1BC1EFF2F49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1626DA-5B19-4291-B840-633EF458984C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B80F8C3B-BEF9-43D5-9455-6C6F608CF519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B457DA44-AD83-4E5C-B180-8A227462EC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68A461E8-C834-4F97-98E3-516A191A3BAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDAE892B-324C-45E3-BFA0-C2B7B6939F54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79983385-D5FE-4F76-924C-A2AA7E5BAAE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open Management Infrastructure Remote Code Execution Vulnerability"
},
{
"lang": "es",
"value": "Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota de Open Management Infrastructure"
}
],
"id": "CVE-2021-38647",
"lastModified": "2025-10-30T19:13:53.830",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2021-09-15T12:15:15.090",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
},
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-38645
Vulnerability from fkie_nvd - Published: 2021-09-15 12:15 - Updated: 2025-10-30 19:14
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
References
Impacted products
{
"cisaActionDue": "2021-11-17",
"cisaExploitAdd": "2021-11-03",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC617A6-F1BC-44DE-A9BB-BECF2E788B0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23A8B342-E863-4C71-9CE1-FB325FF34829",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_diagnostics_\\(lad\\):-:*:*:*:*:*:*:*",
"matchCriteriaId": "37AC51D6-F6F3-45D8-91E7-6EDD01C0273E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8477F336-71BB-4C49-A4EB-E1BC1EFF2F49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1626DA-5B19-4291-B840-633EF458984C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B80F8C3B-BEF9-43D5-9455-6C6F608CF519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B457DA44-AD83-4E5C-B180-8A227462EC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68A461E8-C834-4F97-98E3-516A191A3BAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDAE892B-324C-45E3-BFA0-C2B7B6939F54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79983385-D5FE-4F76-924C-A2AA7E5BAAE8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
},
{
"lang": "es",
"value": "Una Vulnerabilidad de Elevaci\u00f3n de Privilegios en Open Management Infrastructure. Este CVE ID es diferente de CVE-2021-38648, CVE-2021-38649"
}
],
"id": "CVE-2021-38645",
"lastModified": "2025-10-30T19:14:04.183",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2021-09-15T12:15:14.967",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38645"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2025-27743 (GCVE-0-2025-27743)
Vulnerability from cvelistv5 – Published: 2025-04-08 17:23 – Updated: 2025-06-04 17:52
VLAI?
Summary
Untrusted search path in System Center allows an authorized attacker to elevate privileges locally.
Severity ?
CWE
- CWE-426 - Untrusted Search Path
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center Virtual Machine Manager 2022 |
Affected:
N/A
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-08T19:57:39.876585Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T19:57:50.616Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "System Center Virtual Machine Manager 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Virtual Machine Manager 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Virtual Machine Manager 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Data Protection Manager 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Data Protection Manager 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Data Protection Manager 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Orchestrator 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Orchestrator 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Orchestrator 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Service Manager 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Service Manager 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Service Manager 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2025-04-08T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Untrusted search path in System Center allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426: Untrusted Search Path",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-04T17:52:40.439Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft System Center Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27743"
}
],
"title": "Microsoft System Center Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2025-27743",
"datePublished": "2025-04-08T17:23:25.628Z",
"dateReserved": "2025-03-06T04:26:08.553Z",
"dateUpdated": "2025-06-04T17:52:40.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21334 (GCVE-0-2024-21334)
Vulnerability from cvelistv5 – Published: 2024-03-12 16:57 – Updated: 2025-05-03 00:46
VLAI?
Summary
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Severity ?
9.8 (Critical)
CWE
- CWE-416 - Use After Free
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center Operations Manager (SCOM) 2019 |
Affected:
10.19.0 , < 10.19.1253.0
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-12T19:03:15.081748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:37:28.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:39.928Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.1253.0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.22.1070.0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version 1.8.1-0",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.19.1253.0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.22.1070.0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMI version 1.8.1-0",
"versionStartIncluding": "16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-03-12T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-03T00:46:57.699Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334"
}
],
"title": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-21334",
"datePublished": "2024-03-12T16:57:57.499Z",
"dateReserved": "2023-12-08T22:45:19.371Z",
"dateUpdated": "2025-05-03T00:46:57.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21330 (GCVE-0-2024-21330)
Vulnerability from cvelistv5 – Published: 2024-03-12 16:57 – Updated: 2025-05-03 00:46
VLAI?
Summary
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Severity ?
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center Operations Manager (SCOM) 2019 |
Affected:
10.19.0 , < 10.19.1253.0
(custom)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21330",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-12T19:23:30.888206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:37:56.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.1253.0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.22.1070.0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Automation",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA 1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "microsoft-oms-latest with full ID: sha256:855bfeb0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure HDInsight",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "omi-1.8.1-0",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version 1.8.1-0",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.8.1-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA 1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.19.1253.0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.22.1070.0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA 1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*",
"versionEndExcluding": "microsoft-oms-latest with full ID: sha256:855bfeb0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_hdinsights:*:*:*:*:*:*:*:*",
"versionEndExcluding": "omi-1.8.1-0",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMI version 1.8.1-0",
"versionStartIncluding": "16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_suite_agent_for_linux:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.1-0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA 1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-03-12T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-03T00:46:57.058Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330"
}
],
"title": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-21330",
"datePublished": "2024-03-12T16:57:56.930Z",
"dateReserved": "2023-12-08T22:45:19.370Z",
"dateUpdated": "2025-05-03T00:46:57.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-36043 (GCVE-0-2023-36043)
Vulnerability from cvelistv5 – Published: 2023-11-14 17:57 – Updated: 2025-10-08 23:59
VLAI?
Summary
Open Management Infrastructure Information Disclosure Vulnerability
Severity ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center Operations Manager (SCOM) 2022 |
Affected:
10.22.0 , < 1.7.3-0
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-36043",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-29T16:21:34.528157Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:46.082Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:37:41.295Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Open Management Infrastructure Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36043"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.7.3-0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.7.3-0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.7.3-0",
"status": "affected",
"version": "7.6.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "1.7.3-0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "1.7.3-0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "1.7.3-0",
"versionStartIncluding": "7.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-11-14T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure Information Disclosure Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:F/RL:T/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-08T23:59:36.748Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Open Management Infrastructure Information Disclosure Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36043"
}
],
"title": "Open Management Infrastructure Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-36043",
"datePublished": "2023-11-14T17:57:12.619Z",
"dateReserved": "2023-06-20T20:44:39.828Z",
"dateUpdated": "2025-10-08T23:59:36.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-33640 (GCVE-0-2022-33640)
Vulnerability from cvelistv5 – Published: 2022-08-09 19:50 – Updated: 2025-06-05 18:40
VLAI?
Summary
System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Severity ?
CWE
- Elevation of Privilege
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Open Management Infrastructure |
Affected:
16.0 , < 1.6.10-2
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T08:09:22.261Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33640"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-33640",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-05T18:40:24.740798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-05T18:40:29.082Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.6.10-2",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.1158.0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.6.1113.0",
"status": "affected",
"version": "7.6.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.22.1032.0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.10-2",
"versionStartIncluding": "16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.19.1158.0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "7.6.1113.0",
"versionStartIncluding": "7.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.22.1032.0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-08-09T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-02T19:34:24.094Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33640"
}
],
"title": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-33640",
"datePublished": "2022-08-09T19:50:03.000Z",
"dateReserved": "2022-06-14T00:00:00.000Z",
"dateUpdated": "2025-06-05T18:40:29.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-29149 (GCVE-0-2022-29149)
Vulnerability from cvelistv5 – Published: 2022-06-15 21:51 – Updated: 2025-01-02 19:03
VLAI?
Summary
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Severity ?
CWE
- Elevation of Privilege
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Azure Automation State Configuration, DSC Extension |
Affected:
2.0.0 , < DSC Agent versions: 2.71.1.33, 3.0.0.7
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:59.490Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29149"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Azure Automation State Configuration, DSC Extension",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Diagnostics (LAD)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "LAD v4.0.27 and LAD v3.0.137",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Stack Hub",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI Version 1.6.9-1",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.22.1024.0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.1152.0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.6.1108.0",
"status": "affected",
"version": "7.6.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*",
"versionEndExcluding": "LAD v4.0.27 and LAD v3.0.137",
"versionStartIncluding": "3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*",
"versionEndExcluding": "publication",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMI Version 1.6.9-1",
"versionStartIncluding": "16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.22.1024.0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.19.1152.0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "7.6.1108.0",
"versionStartIncluding": "7.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-06-14T07:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-02T19:03:13.161Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149"
}
],
"title": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-29149",
"datePublished": "2022-06-15T21:51:17",
"dateReserved": "2022-04-12T00:00:00",
"dateUpdated": "2025-01-02T19:03:13.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41352 (GCVE-0-2021-41352)
Vulnerability from cvelistv5 – Published: 2021-10-13 00:28 – Updated: 2024-08-04 03:08
VLAI?
Summary
SCOM Information Disclosure Vulnerability
Severity ?
CWE
- Information Disclosure
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center 2016 Operations Manager |
Affected:
7.2.0.0 , < 7.2.12335.0
(custom)
cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:* |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:08:32.224Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41352"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center 2016 Operations Manager",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.2.12335.0",
"status": "affected",
"version": "7.2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center 2019 Operations Manager",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.10550.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:2012:r2:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center 2012 R2 Operations Manager",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.1.10226.1413",
"status": "affected",
"version": "7.1.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-10-12T07:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "SCOM Information Disclosure Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Disclosure",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-29T14:52:46.579Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41352"
}
],
"title": "SCOM Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-41352",
"datePublished": "2021-10-13T00:28:15",
"dateReserved": "2021-09-17T00:00:00",
"dateUpdated": "2024-08-04T03:08:32.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38649 (GCVE-0-2021-38649)
Vulnerability from cvelistv5 – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
CWE
- Elevation of Privilege
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Open Management Infrastructure |
Affected:
16.0 , < OMI Version 1.6.8-1
(custom)
cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:* |
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:19.019Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-38649",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T18:09:12.228704Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2021-11-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:25:32.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
}
],
"timeline": [
{
"lang": "en",
"time": "2021-11-03T00:00:00+00:00",
"value": "CVE-2021-38649 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI Version 1.6.8-1",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version: 1.6.8-1",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation State Configuration, DSC Extension",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Diagnostics (LAD)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "LAD v4.0.13 and LAD v3.0.135",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Stack Hub",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.135",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-09-14T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-28T19:37:21.066Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
}
],
"title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-38649",
"datePublished": "2021-09-15T11:24:09.000Z",
"dateReserved": "2021-08-13T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:25:32.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38648 (GCVE-0-2021-38648)
Vulnerability from cvelistv5 – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
CWE
- Elevation of Privilege
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Open Management Infrastructure |
Affected:
16.0 , < OMI Version 1.6.8-1
(custom)
cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:* |
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:18.994Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-38648",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T18:10:24.645431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2021-11-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:25:32.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
}
],
"timeline": [
{
"lang": "en",
"time": "2021-11-03T00:00:00+00:00",
"value": "CVE-2021-38648 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI Version 1.6.8-1",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version: 1.6.8-1",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation State Configuration, DSC Extension",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Diagnostics (LAD)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "LAD v4.0.13 and LAD v3.0.135",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Stack Hub",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.135",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-09-14T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-28T19:37:20.542Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
}
],
"title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-38648",
"datePublished": "2021-09-15T11:24:08.000Z",
"dateReserved": "2021-08-13T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:25:32.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38647 (GCVE-0-2021-38647)
Vulnerability from cvelistv5 – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Remote Code Execution Vulnerability
Severity ?
9.8 (Critical)
CWE
- Remote Code Execution
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Open Management Infrastructure |
Affected:
16.0 , < OMI Version 1.6.8-1
(custom)
cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:* |
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:18.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-38647",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T14:45:47.017000Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2021-11-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:25:33.144Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"
}
],
"timeline": [
{
"lang": "en",
"time": "2021-11-03T00:00:00+00:00",
"value": "CVE-2021-38647 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI Version 1.6.8-1",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version: 1.6.8-1",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation State Configuration, DSC Extension",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Diagnostics (LAD)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "LAD v4.0.13 and LAD v3.0.135",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Stack Hub",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.135",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-09-14T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-28T19:37:20.007Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
}
],
"title": "Open Management Infrastructure Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-38647",
"datePublished": "2021-09-15T11:24:07.000Z",
"dateReserved": "2021-08-13T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:25:33.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27743 (GCVE-0-2025-27743)
Vulnerability from nvd – Published: 2025-04-08 17:23 – Updated: 2025-06-04 17:52
VLAI?
Summary
Untrusted search path in System Center allows an authorized attacker to elevate privileges locally.
Severity ?
CWE
- CWE-426 - Untrusted Search Path
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center Virtual Machine Manager 2022 |
Affected:
N/A
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-08T19:57:39.876585Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T19:57:50.616Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "System Center Virtual Machine Manager 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Virtual Machine Manager 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Virtual Machine Manager 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Data Protection Manager 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Data Protection Manager 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Data Protection Manager 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Orchestrator 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Orchestrator 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Orchestrator 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Service Manager 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Service Manager 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Service Manager 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager 2019",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager 2022",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager 2025",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_virtual_machine_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_data_protection_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_orchestrator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_service_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionStartIncluding": "N/A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2025-04-08T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Untrusted search path in System Center allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426: Untrusted Search Path",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-04T17:52:40.439Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft System Center Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27743"
}
],
"title": "Microsoft System Center Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2025-27743",
"datePublished": "2025-04-08T17:23:25.628Z",
"dateReserved": "2025-03-06T04:26:08.553Z",
"dateUpdated": "2025-06-04T17:52:40.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21334 (GCVE-0-2024-21334)
Vulnerability from nvd – Published: 2024-03-12 16:57 – Updated: 2025-05-03 00:46
VLAI?
Summary
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Severity ?
9.8 (Critical)
CWE
- CWE-416 - Use After Free
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center Operations Manager (SCOM) 2019 |
Affected:
10.19.0 , < 10.19.1253.0
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-12T19:03:15.081748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:37:28.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:39.928Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.1253.0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.22.1070.0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version 1.8.1-0",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.19.1253.0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.22.1070.0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMI version 1.8.1-0",
"versionStartIncluding": "16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-03-12T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-03T00:46:57.699Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334"
}
],
"title": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-21334",
"datePublished": "2024-03-12T16:57:57.499Z",
"dateReserved": "2023-12-08T22:45:19.371Z",
"dateUpdated": "2025-05-03T00:46:57.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21330 (GCVE-0-2024-21330)
Vulnerability from nvd – Published: 2024-03-12 16:57 – Updated: 2025-05-03 00:46
VLAI?
Summary
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Severity ?
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center Operations Manager (SCOM) 2019 |
Affected:
10.19.0 , < 10.19.1253.0
(custom)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21330",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-12T19:23:30.888206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:37:56.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.1253.0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.22.1070.0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Automation",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA 1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "microsoft-oms-latest with full ID: sha256:855bfeb0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure HDInsight",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "omi-1.8.1-0",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version 1.8.1-0",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.8.1-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA 1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.19.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.19.1253.0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.22.1070.0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA 1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*",
"versionEndExcluding": "microsoft-oms-latest with full ID: sha256:855bfeb0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_hdinsights:*:*:*:*:*:*:*:*",
"versionEndExcluding": "omi-1.8.1-0",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMI version 1.8.1-0",
"versionStartIncluding": "16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_suite_agent_for_linux:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.1-0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA 1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.19.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-03-12T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-03T00:46:57.058Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330"
}
],
"title": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-21330",
"datePublished": "2024-03-12T16:57:56.930Z",
"dateReserved": "2023-12-08T22:45:19.370Z",
"dateUpdated": "2025-05-03T00:46:57.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-36043 (GCVE-0-2023-36043)
Vulnerability from nvd – Published: 2023-11-14 17:57 – Updated: 2025-10-08 23:59
VLAI?
Summary
Open Management Infrastructure Information Disclosure Vulnerability
Severity ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center Operations Manager (SCOM) 2022 |
Affected:
10.22.0 , < 1.7.3-0
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-36043",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-29T16:21:34.528157Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:46.082Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:37:41.295Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Open Management Infrastructure Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36043"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.7.3-0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.7.3-0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.7.3-0",
"status": "affected",
"version": "7.6.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "1.7.3-0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "1.7.3-0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "1.7.3-0",
"versionStartIncluding": "7.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-11-14T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure Information Disclosure Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:F/RL:T/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-08T23:59:36.748Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Open Management Infrastructure Information Disclosure Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36043"
}
],
"title": "Open Management Infrastructure Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-36043",
"datePublished": "2023-11-14T17:57:12.619Z",
"dateReserved": "2023-06-20T20:44:39.828Z",
"dateUpdated": "2025-10-08T23:59:36.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-33640 (GCVE-0-2022-33640)
Vulnerability from nvd – Published: 2022-08-09 19:50 – Updated: 2025-06-05 18:40
VLAI?
Summary
System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Severity ?
CWE
- Elevation of Privilege
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Open Management Infrastructure |
Affected:
16.0 , < 1.6.10-2
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T08:09:22.261Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33640"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-33640",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-05T18:40:24.740798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-05T18:40:29.082Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.6.10-2",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.1158.0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.6.1113.0",
"status": "affected",
"version": "7.6.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.22.1032.0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.10-2",
"versionStartIncluding": "16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.19.1158.0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "7.6.1113.0",
"versionStartIncluding": "7.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.22.1032.0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-08-09T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-02T19:34:24.094Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33640"
}
],
"title": "System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-33640",
"datePublished": "2022-08-09T19:50:03.000Z",
"dateReserved": "2022-06-14T00:00:00.000Z",
"dateUpdated": "2025-06-05T18:40:29.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-29149 (GCVE-0-2022-29149)
Vulnerability from nvd – Published: 2022-06-15 21:51 – Updated: 2025-01-02 19:03
VLAI?
Summary
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Severity ?
CWE
- Elevation of Privilege
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Azure Automation State Configuration, DSC Extension |
Affected:
2.0.0 , < DSC Agent versions: 2.71.1.33, 3.0.0.7
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:59.490Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29149"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Azure Automation State Configuration, DSC Extension",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Diagnostics (LAD)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "LAD v4.0.27 and LAD v3.0.137",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Azure Stack Hub",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.14.13",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI Version 1.6.9-1",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.22.1024.0",
"status": "affected",
"version": "10.22.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.1152.0",
"status": "affected",
"version": "10.19.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM) 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.6.1108.0",
"status": "affected",
"version": "7.6.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*",
"versionEndExcluding": "LAD v4.0.27 and LAD v3.0.137",
"versionStartIncluding": "3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*",
"versionEndExcluding": "publication",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMS Agent for Linux GA v1.14.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "OMI Version 1.6.9-1",
"versionStartIncluding": "16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.22.1024.0",
"versionStartIncluding": "10.22.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "10.19.1152.0",
"versionStartIncluding": "10.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*",
"versionEndExcluding": "7.6.1108.0",
"versionStartIncluding": "7.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-06-14T07:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-02T19:03:13.161Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149"
}
],
"title": "Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-29149",
"datePublished": "2022-06-15T21:51:17",
"dateReserved": "2022-04-12T00:00:00",
"dateUpdated": "2025-01-02T19:03:13.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41352 (GCVE-0-2021-41352)
Vulnerability from nvd – Published: 2021-10-13 00:28 – Updated: 2024-08-04 03:08
VLAI?
Summary
SCOM Information Disclosure Vulnerability
Severity ?
CWE
- Information Disclosure
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | System Center 2016 Operations Manager |
Affected:
7.2.0.0 , < 7.2.12335.0
(custom)
cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:* |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:08:32.224Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41352"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center 2016 Operations Manager",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.2.12335.0",
"status": "affected",
"version": "7.2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center 2019 Operations Manager",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.19.10550.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:2012:r2:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center 2012 R2 Operations Manager",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.1.10226.1413",
"status": "affected",
"version": "7.1.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-10-12T07:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "SCOM Information Disclosure Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Disclosure",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-29T14:52:46.579Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41352"
}
],
"title": "SCOM Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-41352",
"datePublished": "2021-10-13T00:28:15",
"dateReserved": "2021-09-17T00:00:00",
"dateUpdated": "2024-08-04T03:08:32.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38649 (GCVE-0-2021-38649)
Vulnerability from nvd – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
CWE
- Elevation of Privilege
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Open Management Infrastructure |
Affected:
16.0 , < OMI Version 1.6.8-1
(custom)
cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:* |
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:19.019Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-38649",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T18:09:12.228704Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2021-11-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:25:32.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"
}
],
"timeline": [
{
"lang": "en",
"time": "2021-11-03T00:00:00+00:00",
"value": "CVE-2021-38649 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI Version 1.6.8-1",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version: 1.6.8-1",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation State Configuration, DSC Extension",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Diagnostics (LAD)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "LAD v4.0.13 and LAD v3.0.135",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Stack Hub",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.135",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-09-14T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-28T19:37:21.066Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649"
}
],
"title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-38649",
"datePublished": "2021-09-15T11:24:09.000Z",
"dateReserved": "2021-08-13T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:25:32.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38648 (GCVE-0-2021-38648)
Vulnerability from nvd – Published: 2021-09-15 11:24 – Updated: 2025-10-21 23:25
VLAI?
Summary
Open Management Infrastructure Elevation of Privilege Vulnerability
Severity ?
CWE
- Elevation of Privilege
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Open Management Infrastructure |
Affected:
16.0 , < OMI Version 1.6.8-1
(custom)
cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:* |
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:18.994Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-38648",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T18:10:24.645431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2021-11-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:25:32.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648"
}
],
"timeline": [
{
"lang": "en",
"time": "2021-11-03T00:00:00+00:00",
"value": "CVE-2021-38648 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Open Management Infrastructure",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI Version 1.6.8-1",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "System Center Operations Manager (SCOM)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMI version: 1.6.8-1",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation State Configuration, DSC Extension",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Automation Update Management",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Log Analytics Agent",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Diagnostics (LAD)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "LAD v4.0.13 and LAD v3.0.135",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Container Monitoring Solution",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Security Center",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Sentinel",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "OMS Agent for Linux GA v1.13.40-0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Azure Stack Hub",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.135",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-09-14T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Open Management Infrastructure Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-28T19:37:20.542Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html"
}
],
"title": "Open Management Infrastructure Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-38648",
"datePublished": "2021-09-15T11:24:08.000Z",
"dateReserved": "2021-08-13T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:25:32.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}