Vulnerability · Published Jun 15, 2022 · Assigned by microsoft
CVE-2022-29149Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
High 7.8
In plain English
A high-severity security flaw in Azure Automation State Configuration, DSC Extension from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.0%top 38.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Azure Automation State Configuration, DSC Extension | 2.0.0 – before DSC Agent versions: 2.71.1.33, 3.0.0.7 |
| Microsoft | Azure Automation Update Management | 1.0.0 – before OMS Agent for Linux GA v1.14.13 |
| Microsoft | Log Analytics Agent | 1.0.0 – before OMS Agent for Linux GA v1.14.13 |
| Microsoft | Azure Diagnostics (LAD) | 3.0.0 – before LAD v4.0.27 and LAD v3.0.137 |
| Microsoft | Container Monitoring Solution | 1.0.0 – before publication |
| Microsoft | Azure Security Center | 1.0.0 – before OMS Agent for Linux GA v1.14.13 |
| Microsoft | Azure Sentinel | 1.0.0 – before OMS Agent for Linux GA v1.14.13 |
| Microsoft | Azure Stack Hub | 1.0.0 – before OMS Agent for Linux GA v1.14.13 |
| Microsoft | Open Management Infrastructure | 16.0 – before OMI Version 1.6.9-1 |
| Microsoft | System Center Operations Manager (SCOM) 2022 | 10.22.0 – before 10.22.1024.0 |
| Microsoft | System Center Operations Manager (SCOM) 2019 | 10.19.0 – before 10.19.1152.0 |
| Microsoft | System Center Operations Manager (SCOM) 2016 | 7.6.0 – before 7.6.1108.0 |
References
- Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability vendor-advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29149 x_refsource_MISC, x_transferred