KLA65131 Multiple vulnerabilities in Microsoft Azure

🗓️ 12 Mar 2024 00:00:00Reported by Kaspersky LabType

kaspersky

kaspersky🔗 threats.kaspersky.com👁 56 Views

Multiple vulnerabilities in Microsoft Azure. Malicious users can exploit to gain privileges, execute arbitrary code

Reporter	Title	Published	Views	Family All 84
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM on Azure Cloud deployed from Azure Marketplace is vulnerable to remote code execution (CVE-2024-21334)	1 May 202413:09	–	ibm
Tenable Nessus	Microsoft Azure CLI Confcom Extension < 0.3.3 Privilege Escalation	26 Apr 202400:00	–	nessus
Tenable Nessus	Microsoft Azure Data Studio < 1.48.0 Elevation of Privilege Vulnerability (CVE-2024-26203)	15 Mar 202400:00	–	nessus
Tenable Nessus	Security Updates for Microsoft Open Management Infrastructure (March 2024)	20 Mar 202400:00	–	nessus
Tenable Nessus	Security Updates for Microsoft System Center Management Pack (March 2024)	12 Mar 202400:00	–	nessus
BDU FSTEC	The vulnerability of the enterprise management server through the Internet Open Management Infrastructure (OMI) relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.	15 Mar 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the enterprise management server through the Internet-based Open Management Infrastructure (OMI) extensions for managing virtual machines in Azure allows attackers to escalate their privileges due to lack of access control mechanisms.	18 Mar 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Azure SDK software development kit, related to errors in user interface representation, allows attackers to perform spoofing attacks.	18 Mar 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Azure Data Studio software for data development and management, which involves connecting to cloud and local databases, stems from lack of access control mechanisms. This allows attackers to exploit their privileges.	19 Mar 202400:00	–	bdu_fstec
BDU FSTEC	Vulnerability of the monitoring and network equipment management system: Software for Open Networking in the Cloud (SONiC). This vulnerability stems from lack of access control measures, allowing attackers to enhance their privileges.	19 Mar 202400:00	–	bdu_fstec

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26203
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21421
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21400
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21334
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21418
threats	www.threats.kaspersky.com/en/product/Microsoft-Azure/
statistics	www.statistics.securelist.com/

26 Mar 2025 00:00Current

9.5High risk

Vulners AI Score9.5

CVSS 3.19.8

EPSS0.20157

SSVC

microsoft azure vulnerabilities privileges arbitrary code exploits sdk open management infrastructure sonic sentinel automation kubernetes update management container monitoring security center data studio log analytics agent ace cve-ids microsoft official advisories