Kaspersky LabKLA65507KLA65507 Multiple vulnerabilities in Microsoft Azure
9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
8.7 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
27.5%
Detect date:
04/09/2024
Severity:
High
Description:
Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, obtain sensitive information.
Affected products:
Azure Monitor Agent
Azure Arc Cluster microsoft.azurekeyvaultsecretsprovider Extension
Azure Arc Cluster microsoft.videoindexer Extension
Azure Migrate
Azure Compute Gallery
Azure Arc Cluster microsoft.networkfabricserviceextension Extension
Azure Kubernetes Service Confidential Containers
Azure Arc Cluster microsoft.openservicemesh Extension
Azure Arc Cluster microsoft.iotoperations.mq Extension
Azure AI Search
Azure Arc Cluster microsoft.azure.hybridnetwork Extension
Azure Arc Cluster microsoft.azstackhci.operator Extension
Azure Identity Library for .NET
Azure Private 5G Core
Azure CycleCloud 8.6.0
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
CVE-2024-29990
CVE-2024-26193
CVE-2024-20685
CVE-2024-21424
CVE-2024-29989
CVE-2024-28917
CVE-2024-29063
CVE-2024-29992
CVE-2024-29993
Impacts:
ACE
Related products:
CVE-IDS:
CVE-2024-299909.0Critical
CVE-2024-261936.4High
CVE-2024-206855.9High
CVE-2024-214246.5High
CVE-2024-299898.4High
CVE-2024-289176.2High
CVE-2024-290637.3High
CVE-2024-299925.5High
CVE-2024-299938.8High
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20685
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21424
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26193
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28917
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29063
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29989
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29990
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29992
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29993
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20685
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21424
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26193
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28917
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29063
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29989
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29990
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29992
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29993
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/product/.NET/
threats.kaspersky.com/en/product/Microsoft-Azure/
Related
9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
8.7 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
27.5%