CVE-2021-38649
Published: 15 September 2021
Summary
CVE-2021-38649 is a high-severity an unspecified weakness vulnerability in Microsoft Azure Automation State Configuration. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 8.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-38649 is an elevation of privilege vulnerability affecting the Open Management Infrastructure component. It carries a CVSS 3.1 base score of 7.0 with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that successful exploitation can allow an attacker to obtain full control over confidentiality, integrity, and availability on the affected system.
A local attacker with low privileges can exploit the flaw, though the attack requires high complexity and no user interaction. Successful exploitation enables the attacker to elevate privileges on the target system to achieve high impact across confidentiality, integrity, and availability.
Microsoft security guidance and the CISA Known Exploited Vulnerabilities catalog reference this issue, confirming that it has been observed in real-world exploitation and directing administrators to apply available updates or mitigations through official Microsoft channels.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-25088
Vulnerability details
Open Management Infrastructure Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the vendor patches that close the OMI privilege-escalation flaw.
Enforces least-privilege restrictions so a low-privileged local account cannot obtain the elevated rights the vulnerability would otherwise grant.
Access-enforcement mechanisms block the unauthorized elevation path that the OMI flaw exploits.