CVE-2021-38648
Published: 15 September 2021
Summary
CVE-2021-38648 is a high-severity an unspecified weakness vulnerability in Microsoft Azure Automation State Configuration. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2021-38648 is an elevation of privilege vulnerability affecting the Open Management Infrastructure (OMI) component. It carries a CVSS 3.1 base score of 7.8 with an attack vector of local access, low attack complexity, and low privileges required, resulting in high impact to confidentiality, integrity, and availability under an unchanged scope.
A local attacker who already possesses low-privileged access on an affected system can exploit the flaw to bypass authentication controls in the OMI management interface and obtain full administrative privileges, enabling arbitrary code execution or complete system compromise.
Microsoft security guidance referenced in the advisory provides official remediation steps and patches, while the vulnerability is also tracked in the CISA Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-25087
Vulnerability details
Open Management Infrastructure Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authentication and authorization checks that the OMI flaw bypasses to allow local privilege escalation.
Requires identification and authentication of organizational users before granting access to the OMI management interface.
Limits privileges assigned to local accounts so that even a successful bypass yields only the minimum necessary rights.