CVE-2024-43591: Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability

Critical severity · published Oct 8, 2024

CVE-2024-43591

Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability

9.1

CVSS

1.6%

EPSS

On KEV

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 76% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Azure CLI · Microsoft

2.0.0 before 2.65.0 · source: vendor

Azure Service Connector · Microsoft

0.0.0 before 2.65.0 · source: vendor, NVD

Azure Command-line Interface · Microsoft

before 2.65.0 · source: NVD

Affected product

Azure CLI

Microsoft

All Azure CLI CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-43591

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-43591

Patch

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43591