{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "R4nger \u0026amp; Zhiniang Peng"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-21329 Azure Connected Machine Agent Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21329"
      },
      {
        "category": "self",
        "summary": "CVE-2024-21329 Azure Connected Machine Agent Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-21329.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Azure Connected Machine Agent Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2024-03-20T07:00:00.000Z",
      "generator": {
        "date": "2025-05-03T01:36:59.760Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-21329",
      "initial_release_date": "2024-02-13T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-02-13T08:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2024-02-15T08:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "In the Security Updates table, removed the Article and Download links because the update is not available for Azure Connected Machine Agent. Customers will be notified via a revision to this CVE information when the update becomes available."
        },
        {
          "date": "2024-03-20T07:00:00.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "The security update 1.38 for Azure Connected Machine Agent is now available. See the Security Updates table for more information."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.38",
            "product": {
              "name": "Azure Connected Machine Agent \u003c1.38",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "1.38",
            "product": {
              "name": "Azure Connected Machine Agent 1.38",
              "product_id": "12264"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Connected Machine Agent"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-21329",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "The update was removed from the Microsoft Update Catalog due to reports of installation failing. The update will be re-released when the issue is resolved, and this CVE will be updated at that time.",
          "title": "Why is the update for Azure Connected Machine Agents unavailable?"
        },
        {
          "category": "faq",
          "text": "A non-admin local user who has sufficient permissions to create symbolic links on a Windows computer that has Azure Connected Machine Agent installed (or before the agent is installed) could create links from a directory used by the agent to other privileged files on the computer. If the administrator later installs virtual machine extensions on the machine, those files could be deleted.",
          "title": "According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited the vulnerability could add symlinks and cause an arbitrary file delete as SYSTEM.",
          "title": "What privileges could an attacker gain with successful exploitation?"
        }
      ],
      "product_status": {
        "fixed": [
          "12264"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21329 Azure Connected Machine Agent Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21329"
        },
        {
          "category": "self",
          "summary": "CVE-2024-21329 Azure Connected Machine Agent Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-21329.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-02-13T08:00:00.000Z",
          "details": "1.38:Security Update:https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-release-notes",
          "product_ids": [
            "1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-release-notes"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.4,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Azure Connected Machine Agent Elevation of Privilege Vulnerability"
    }
  ]
}