CVE-2021-38645

🗓️ 15 Sep 2021 11:24:05Reported by microsoftType

Open Management Infrastructure Elevation of Privilege Vulnerability CVE-2021-3864

Reporter	Title	Published	Views	Family All 31
ATTACKERKB	CVE-2021-38645	15 Sep 202100:00	–	attackerkb
Tenable Nessus	Microsoft Open Management Infrastructure < 1.6.8.1 Multiple Vulnerabilities	17 Sep 202100:00	–	nessus
Tenable Nessus	Microsoft Open Management Infrastructure (OMI) package < 1.6.8-1 Multiple Vulnerabilities	17 Sep 202100:00	–	nessus
BDU FSTEC	The vulnerability of the enterprise management server through the Internet-based Open Management Infrastructure (OMI) for virtual machine management in Azure allows attackers to escalate their privileges due to lack of access control mechanisms.	7 Dec 202100:00	–	bdu_fstec
Circl	CVE-2021-38645	15 Sep 202116:22	–	circl
CISA KEV Catalog	Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability	3 Nov 202100:00	–	cisa_kev
CISA	Microsoft Releases Security Update for Azure Linux Open Management Infrastructure	16 Sep 202100:00	–	cisa
CNNVD	Microsoft Azure Open Management Infrastructure 权限许可和访问控制问题漏洞	14 Sep 202100:00	–	cnnvd
Cvelist	CVE-2021-38645 Open Management Infrastructure Elevation of Privilege Vulnerability	15 Sep 202111:24	–	cvelist
Kaspersky	KLA12286 Mutliple vulnerabilities in Microsoft Azure	14 Sep 202100:00	–	kaspersky

NVD

Vulners

CNA

Node

microsoft azure_automation_state_configurationMatch-

microsoft azure_automation_update_managementMatch-

microsoft azure_diagnostics_(lad)Match-

microsoft azure_security_centerMatch-

microsoft azure_sentinelMatch-

microsoft azure_stack_hubMatch-

microsoft container_monitoring_solutionMatch-

microsoft log_analytics_agentMatch-

microsoft open_management_infrastructureRange<1.6.8-1

microsoft system_center_operations_managerMatch-

[
  {
    "vendor": "Microsoft",
    "product": "Azure Automation State Configuration, DSC Extension",
    "versions": [
      {
        "version": "2.0.0",
        "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Automation Update Management",
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.13.40-0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Diagnostics (LAD)",
    "versions": [
      {
        "version": "3.0.0",
        "lessThan": "LAD v4.0.13 and LAD v3.0.135",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Security Center",
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.13.40-0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Sentinel",
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.13.40-0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Stack Hub",
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Container Monitoring Solution",
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Log Analytics Agent",
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.13.40-0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Open Management Infrastructure",
    "versions": [
      {
        "version": "16.0",
        "lessThan": "OMI Version 1.6.8-1",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "System Center Operations Manager (SCOM)",
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMI version: 1.6.8-1",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38645
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38645

10 Aug 2026 20:18Current

8.6High risk

Vulners AI Score8.6

CVSS 24.6

CVSS 3.17.8

EPSS0.0189

SSVC

In Wild