CVE-2024-49056
Airlift Microsoft Com
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2024-49056 is a high-severity Authentication Bypass by Assumed-Immutable Data (CWE-302) vulnerability in Microsoft Airlift Microsoft Com. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43923
Vulnerability Data
Authentication bypass by assumed-immutable data on airlift.microsoft.com allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V7.2.4
Mitigating Controls (NIST 800-53 r5) AI
Mandates proper unique identification and authentication of users, precluding reliance on attacker-controlled immutable assumptions.
Requires server-side enforcement of authorizations instead of trusting client-supplied mutable data for authentication decisions.
Mandates proper identification and authentication for non-organizational users, precluding reliance on attacker-controlled immutable assumptions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly avoid reliance on attacker-controlled immutable data.
Protecting and verifying identity assertions prevents tampering with data assumed immutable during auth.
Least-privilege authorization policies reduce impact of bypassed authentication but do not address the root flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover and block authentication bypasses that rely on mutable data.
Access-control policy can mandate validation of all identity data, reducing reliance on assumed-immutable fields.
Identity-management processes can require verification of mutable attributes, mitigating the root cause.
Proper management of authentication information prevents use of client-controlled tokens or cookies as sole proof of identity.
Access-rights reviews can detect and revoke rights granted via tampered immutable data.
Secure SDLC practices include threat modeling and input-validation requirements that catch assumed-immutable data flaws.