CVE-2022-29149 Azure Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability

2022-06-1521:51:17

microsoft

www.cve.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

0.0004 Low

EPSS

Percentile

9.5%

JSON

CNA Affected

[
  {
    "vendor": "Microsoft",
    "product": "Azure Automation State Configuration, DSC Extension",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "2.0.0",
        "lessThan": "DSC Agent versions: 2.71.1.33, 3.0.0.7",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Automation Update Management",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.14.13",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Log Analytics Agent",
    "cpes": [
      "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.14.13",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Diagnostics (LAD)",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "3.0.0",
        "lessThan": "LAD v4.0.27 and LAD v3.0.137",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Container Monitoring Solution",
    "cpes": [
      "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Security Center",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.14.13",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Sentinel",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.14.13",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Azure Stack Hub",
    "cpes": [
      "cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "1.0.0",
        "lessThan": "OMS Agent for Linux GA v1.14.13",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Open Management Infrastructure",
    "cpes": [
      "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "16.0",
        "lessThan": "OMI Version 1.6.9-1",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "System Center Operations Manager (SCOM) 2022",
    "cpes": [
      "cpe:2.3:a:microsoft:system_center_operations_manager:2022:-:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "10.22.0",
        "lessThan": "10.22.1024.0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "System Center Operations Manager (SCOM) 2019",
    "cpes": [
      "cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "10.19.0",
        "lessThan": "10.19.1152.0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "System Center Operations Manager (SCOM) 2016",
    "cpes": [
      "cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "7.6.0",
        "lessThan": "7.6.1108.0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]