Lucene search

MicrosoftCVE-2021-38648

HistorySep 15, 2021 - 12:15 p.m.

CVE-2021-38648

2021-09-1512:15:15

CWE-287

microsoft

web.nvd.nist.gov

941

In Wild

cve

2021

38648

omi

privilege

vulnerability

nvd

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.967

Percentile

99.7%

JSON

Open Management Infrastructure Elevation of Privilege Vulnerability

Affected configurations

Nvd

Vulners

Node

microsoftazure_automation_state_configurationMatch-

microsoftazure_automation_update_managementMatch-

microsoftazure_diagnostics_\(lad\)Match-

microsoftazure_open_management_infrastructureMatch-

microsoftazure_security_centerMatch-

microsoftazure_sentinelMatch-

microsoftazure_stack_hubMatch-

microsoftcontainer_monitoring_solutionMatch-

microsoftlog_analytics_agentMatch-

microsoftsystem_center_operations_managerMatch-

VendorProductVersionCPE
microsoftazure_automation_state_configuration-cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
microsoftazure_automation_update_management-cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
microsoftazure_diagnostics_\(lad\)-cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:*
microsoftazure_open_management_infrastructure-cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*
microsoftazure_security_center-cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*
microsoftazure_sentinel-cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*
microsoftazure_stack_hub-cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*
microsoftcontainer_monitoring_solution-cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
microsoftlog_analytics_agent-cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
microsoftsystem_center_operations_manager-cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	azure_automation_state_configuration	-	cpe:2.3:a:microsoft:azure_automation_state_configuration:-:::::::*
microsoft	azure_automation_update_management	-	cpe:2.3:a:microsoft:azure_automation_update_management:-:::::::*
microsoft	azure_diagnostics_\(lad\)	-	cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:::::::*
microsoft	azure_open_management_infrastructure	-	cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:::::::*
microsoft	azure_security_center	-	cpe:2.3:a:microsoft:azure_security_center:-:::::::*
microsoft	azure_sentinel	-	cpe:2.3:a:microsoft:azure_sentinel:-:::::::*
microsoft	azure_stack_hub	-	cpe:2.3:a:microsoft:azure_stack_hub:-:::::::*
microsoft	container_monitoring_solution	-	cpe:2.3:a:microsoft:container_monitoring_solution:-:::::::*
microsoft	log_analytics_agent	-	cpe:2.3:a:microsoft:log_analytics_agent:-:::::::*
microsoft	system_center_operations_manager	-	cpe:2.3:a:microsoft:system_center_operations_manager:-:::::::*

CNA Affected

[
  {
    "vendor": "Microsoft",
    "product": "Open Management Infrastructure",
    "cpes": [
      "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "16.0",
        "lessThan": "OMI Version 1.6.8-1",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "System Center Operations Manager (SCOM)",
    "cpes": [
      "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMI version: 1.6.8-1",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Automation State Configuration, DSC Extension",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "2.0.0",
        "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Automation Update Management",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.13.40-0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Log Analytics Agent",
    "cpes": [
      "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.13.40-0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Diagnostics (LAD)",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "3.0.0",
        "lessThan": "LAD v4.0.13 and LAD v3.0.135",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Container Monitoring Solution",
    "cpes": [
      "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Security Center",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.13.40-0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Sentinel",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.13.40-0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Stack Hub",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
        "versionType": "custom",
        "status": "affected"
      },
      {
        "version": "1.0.0",
        "lessThan": "3.1.135",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]