by Kastro
Paper/Archive/CVE-2021-38647

CVE-2021-38647

Microsoft Azure Automation State Configuration, DSC Extension — Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

KEV · due 17 Novransomware useEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Affected

ProductAffectedFixed inSource
Azure Automation State Configuration, DSC Extension2.0.0 – < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3CNA
Azure Automation Update Management1.0.0 – < OMS Agent for Linux GA v1.13.40-0OMS Agent for Linux GA v1.13.40-0CNA
Azure Diagnostics (LAD)3.0.0 – < LAD v4.0.13 and LAD v3.0.135LAD v4.0.13 and LAD v3.0.135CNA
Azure Security Center1.0.0 – < OMS Agent for Linux GA v1.13.40-0OMS Agent for Linux GA v1.13.40-0CNA
Azure Sentinel1.0.0 – < OMS Agent for Linux GA v1.13.40-0OMS Agent for Linux GA v1.13.40-0CNA
Azure Stack Hub1.0.0 – < Monitor, Update and Config Mgmnt 1.14.01Monitor, Update and Config Mgmnt 1.14.01CNA
Container Monitoring Solution1.0.0 – < publicationpublicationCNA
Log Analytics Agent1.0.0 – < OMS Agent for Linux GA v1.13.40-0OMS Agent for Linux GA v1.13.40-0CNA
Open Management Infrastructure16.0 – < OMI Version 1.6.8-1OMI Version 1.6.8-1CNA
System Center Operations Manager (SCOM)1.0.0 – < OMI version: 1.6.8-1OMI version: 1.6.8-1CNA

Scores by source

microsoft (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647refportal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647refpacketstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647kevcisa.gov/known-exploited-vulnerabilities-catalog