CVE-2021-27075

🗓️ 11 Mar 2021 15:50:50Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 79 Views🌐 WEB

CVE-2021-27075 Azure VM Information Disclosur

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerabilities of Azure Container Instance, Azure Service Fabric, Azure Kubernetes Service, Azure Container Registry, and Azure Spring Cloud involve a lack of protection for service data, allowing attackers to gain unauthorized access to protected information.	17 Mar 202100:00	–	bdu_fstec
Circl	CVE-2021-27075	17 Jun 202115:14	–	circl
CNNVD	Microsoft Windows 虚拟机信息泄露漏洞	9 Mar 202100:00	–	cnnvd
Cvelist	CVE-2021-27075 Azure Virtual Machine Information Disclosure Vulnerability	11 Mar 202115:50	–	cvelist
EUVD	EUVD-2021-13846	7 Oct 202500:30	–	euvd
Kaspersky	KLA12123 Multiple vulnerabilities in Microsoft Azure	9 Mar 202100:00	–	kaspersky
Microsoft CVE	Azure Virtual Machine Information Disclosure Vulnerability	9 Mar 202108:00	–	mscve
NCSC	Vulnerability fixed in Microsoft Azure	9 Mar 202100:00	–	ncsc
NVD	CVE-2021-27075	11 Mar 202116:15	–	nvd
OSV	CVE-2021-27075	11 Mar 202116:15	–	osv

NVD

Vulners

Node

microsoft azure_container_instancesMatch-

microsoft azure_container_registryMatch-

microsoft azure_kubernetes_serviceMatch-

microsoft azure_service_fabricMatch-

microsoft azure_spring_cloudMatch-

[
  {
    "vendor": "Microsoft",
    "product": "Azure Service Fabric",
    "cpes": [],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Spring Cloud",
    "cpes": [],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Container Instance",
    "cpes": [],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Kubernetes Service",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_kubernetes_service:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27075

Parameter	Position	Path	Description	CWE
transport certificate	path	168.63.129.16/Certificates	Certificates endpoint can be misused to obtain encrypted extension keys when attacked with a forged transport certificate	CWE-264
encrypted extension keys	path	168.63.129.16/Certificates	Certificates endpoint can be misused to obtain encrypted extension keys when attacked with a forged transport certificate	CWE-264
protectedSettings	path	168.63.129.16/Certificates	Certificates endpoint can be misused to obtain encrypted extension keys when attacked with a forged transport certificate	CWE-264
GoalState	path	168.63.129.16/GoalState	GoalState endpoint yields configuration including ExtensionsConfig used to retrieve extension data; may be abused to locate sensitive config	CWE-264
ExtensionsConfig	path	168.63.129.16/GoalState	GoalState endpoint yields configuration including ExtensionsConfig used to retrieve extension data; may be abused to locate sensitive config	CWE-264
protectedSettings	path	168.63.129.16/ExtensionsConfig	ExtensionsConfig response may contain protectedSettings and private keys which attackers could decrypt if keys are compromised	CWE-264
private keys	path	168.63.129.16/ExtensionsConfig	ExtensionsConfig response may contain protectedSettings and private keys which attackers could decrypt if keys are compromised	CWE-264

17 Jun 2026 03:44Current

6.3Medium risk

Vulners AI Score6.3

CVSS 22.7

CVSS 3.16.8

EPSS0.01343