ZDI-24-988: Microsoft Azure MQTT azure-iot-sdks-ci Uncontrolled Search Path Element Remote Code Execution Vulnerability
Published Jul 29, 2024
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
Affected Software
1 affected component
Microsoft Azure
Event History
Jul 29, 2024
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-24-988?
The severity of ZDI-24-988 is rated at 9.8 on the CVSS scale, indicating a critical vulnerability.
2
How do I fix ZDI-24-988?
To fix ZDI-24-988, update your Microsoft Azure installations to the latest patched version provided by Microsoft.
3
What type of attacks can occur due to ZDI-24-988?
ZDI-24-988 allows remote attackers to execute arbitrary code, potentially leading to complete system compromise.
4
Is authentication required to exploit ZDI-24-988?
No, authentication is not required to exploit ZDI-24-988, making it particularly dangerous.
5
Which software is affected by ZDI-24-988?
ZDI-24-988 affects installations of Microsoft Azure.