ZDI-CAN-23268: ZDI-24-988: Microsoft Azure MQTT azure-iot-sdks-ci Uncontrolled Search Path Element Remote Code Execution Vulnerability
Published Jul 29, 2024
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
Affected Software
1 affected component
Microsoft Azure
Event History
Jul 29, 2024
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-23268?
ZDI-CAN-23268 has a CVSS rating of 9.8, indicating it is a critical vulnerability.
2
What type of vulnerability is ZDI-CAN-23268?
ZDI-CAN-23268 is a remote code execution vulnerability in Microsoft Azure.
3
Who is affected by ZDI-CAN-23268?
Any installations of Microsoft Azure are vulnerable to ZDI-CAN-23268.
4
Is authentication required to exploit ZDI-CAN-23268?
No, authentication is not required to exploit ZDI-CAN-23268.
5
How can I mitigate the risks associated with ZDI-CAN-23268?
To mitigate the risks of ZDI-CAN-23268, apply all recommended patches and updates from Microsoft Azure.