CVE-2019-0962: Medium severity microsoft azure automation vulnerability

Published Jul 15, 2019

Updated

An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure Automation Elevation of Privilege Vulnerability'.

Affected Software

1 affected component

Microsoft Azure Automation

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0962

Event History

Jul 15, 2019

CVE Published

via MITRE·06:56 PM

Data Sourced

via MITRE·06:56 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-0962?

CVE-2019-0962 has a severity rating that allows unprivileged users with a contributor role to execute unauthorized actions in Azure Automation.

How do I fix CVE-2019-0962?

To mitigate CVE-2019-0962, you should review and adjust permissions for 'RunAs accounts' in your Azure Automation environments.

Who is affected by CVE-2019-0962?

CVE-2019-0962 affects users with the contributor role in Azure Automation who have access to 'RunAs account' runbooks.

What is a RunAs account in the context of CVE-2019-0962?

In CVE-2019-0962, a RunAs account allows automated runbooks in Azure Automation to perform actions on behalf of users.

Can CVE-2019-0962 lead to a data breach?

Yes, CVE-2019-0962 can potentially lead to a data breach as it allows unauthorized elevation of privileges within Azure Automation.