Actively exploited · Published Sep 15, 2021 · Assigned by microsoft
CVE-2021-38649Open Management Infrastructure Elevation of Privilege Vulnerability
High 7.0 Exploited
In plain English
A high-severity security flaw in Azure Automation State Configuration, DSC Extension from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)2.9%top 13.1% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 17, 2021.
Official description
Open Management Infrastructure Elevation of Privilege Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Azure Automation State Configuration, DSC Extension | 2.0.0 – before DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 |
| Microsoft | Azure Automation Update Management | 1.0.0 – before OMS Agent for Linux GA v1.13.40-0 |
| Microsoft | Azure Diagnostics (LAD) | 3.0.0 – before LAD v4.0.13 and LAD v3.0.135 |
| Microsoft | Azure Security Center | 1.0.0 – before OMS Agent for Linux GA v1.13.40-0 |
| Microsoft | Azure Sentinel | 1.0.0 – before OMS Agent for Linux GA v1.13.40-0 |
| Microsoft | Azure Stack Hub | 1.0.0 – before Monitor, Update and Config Mgmnt 1.14.01 |
| Microsoft | Container Monitoring Solution | 1.0.0 – before publication |
| Microsoft | Log Analytics Agent | 1.0.0 – before OMS Agent for Linux GA v1.13.40-0 |
| Microsoft | Open Management Infrastructure | 16.0 – before OMI Version 1.6.8-1 |
| Microsoft | System Center Operations Manager (SCOM) | 1.0.0 – before OMI version: 1.6.8-1 |
References
- Open Management Infrastructure Elevation of Privilege Vulnerability vendor-advisory, patch
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649 x_refsource_MISC, x_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649 government-resource