CVE-2021-38649: Open Management Infrastructure Elevation of Privilege Vulnerability

Published Sep 15, 2021

Updated

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.

Other sources

Open Management Infrastructure Elevation of Privilege Vulnerability

— NVD

Affected Software

11 affected components

Microsoft Open Management Infrastructure (OMI)

Microsoft Azure Automation State Configuration

Microsoft Azure Automation Update Management

Microsoft Azure Diagnostics \(lad\)

Microsoft Azure Open Management Infrastructure

Microsoft Azure Security Center

Microsoft Azure Sentinel

Microsoft Azure Stack Hub

Microsoft Container Monitoring Solution

Microsoft Log Analytics Agent

Microsoft System Center Operations Manager

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649

Event History

Sep 15, 2021

CVE Published

via MITRE·11:24 AM

Data Sourced

via MITRE·11:24 AM

DescriptionSeverity

Data Sourced

via NVD·12:15 PM

RemedyDescriptionSeverityAffected Software

Nov 3, 2021

Known Exploited

via CISA·12:00 AM

Frequently Asked Questions

What is CVE-2021-38649?

CVE-2021-38649 is a privilege escalation vulnerability in Microsoft Open Management Infrastructure (OMI).

What is the severity of CVE-2021-38649?

CVE-2021-38649 has a severity rating of 7.8 (high).

Which software is affected by CVE-2021-38649?

Microsoft Open Management Infrastructure (OMI), Azure VM Management Extensions, Azure Automation State Configuration, Azure Automation Update Management, Azure Diagnostics (LAD), Azure Security Center, Azure Sentinel, Azure Stack Hub, Container Monitoring Solution, Log Analytics Agent, and System Center Operations Manager are affected by CVE-2021-38649.

What is the vulnerability description of CVE-2021-38649?

CVE-2021-38649 is an unspecified vulnerability in Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions that allows privilege escalation.

Is there any reference available for CVE-2021-38649?

Yes, you can find more information about CVE-2021-38649 at [Microsoft Security Guidance Advisory](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649).