WID-SEC-W-2024-0362

Vulnerability from csaf_certbund - Published: 2024-02-13 23:00 - Updated: 2024-02-13 23:00
Summary
Microsoft Azure: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Azure ist eine Cloud Computing-Plattform von Microsoft. Microsoft Azure DevOps Server ist eine Plattform für kollaborative Softwareprojekte. Azure Stack ist ein Microsoft-Produkt aus der Azure-Familie. Mit Azure Stack können die Public-Cloud-Services von Microsoft auch im eigenen Rechenzentrum betrieben werden.
Angriff: Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Azure ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und Daten falsch darzustellen.
Betroffene Betriebssysteme: - Windows
CVE-2024-21403
Affected products
Product Identifier Version Remediation
Microsoft Azure Site Recovery
Microsoft / Azure
 cpe:/a:microsoft:azure:site_recovery Site Recovery
Microsoft Azure Stack Hub
Microsoft / Azure Stack
 cpe:/a:microsoft:azure_stack:hub Hub
Microsoft Azure Kubernetes Service Confidential Containers
Microsoft / Azure
 cpe:/a:microsoft:azure:kubernetes_service_confidential_containers Kubernetes Service Confidential Containers
Microsoft Azure DevOps Server 2022.1
Microsoft / Azure DevOps Server
 cpe:/o:microsoft:azure_devops_server:2022.1 2022.1
Microsoft Azure Active Directory B2C
Microsoft / Azure
 cpe:/a:microsoft:azure:active_directory_b2c Active Directory B2C
Microsoft Azure Connected Machine Agent
Microsoft / Azure
 cpe:/a:microsoft:azure:connected_machine_agent Connected Machine Agent
Microsoft Azure File Sync v16.0
Microsoft / Azure
 cpe:/a:microsoft:azure:file_sync_v16.0 File Sync v16.0
Microsoft Azure File Sync v17.0
Microsoft / Azure
 cpe:/a:microsoft:azure:file_sync_v17.0 File Sync v17.0
Microsoft Azure File Sync v14.0
Microsoft / Azure
 cpe:/a:microsoft:azure:file_sync_v14.0 File Sync v14.0
Microsoft Azure File Sync v15.0
Microsoft / Azure
 cpe:/a:microsoft:azure:file_sync_v15.0 File Sync v15.0
CVE-2024-21401
Affected products
Known affected 10 products, the same list as for CVE-2024-21403
CVE-2024-21397
Affected products
Known affected 10 products, the same list as for CVE-2024-21403
CVE-2024-21381
Affected products
Known affected 10 products, the same list as for CVE-2024-21403
CVE-2024-21376
Affected products
Known affected 10 products, the same list as for CVE-2024-21403
CVE-2024-21364
Affected products
Known affected 10 products, the same list as for CVE-2024-21403
CVE-2024-21329
Affected products
Known affected 10 products, the same list as for CVE-2024-21403
CVE-2024-20679
Affected products
Known affected 10 products, the same list as for CVE-2024-21403
CVE-2024-20667
Affected products
Known affected 10 products, the same list as for CVE-2024-21403
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Azure ist eine Cloud Computing-Plattform von Microsoft.\r\nMicrosoft Azure DevOps Server ist eine Plattform f\u00fcr kollaborative Softwareprojekte.\r\nAzure Stack ist ein Microsoft-Produkt aus der Azure-Familie. Mit Azure Stack k\u00f6nnen die Public-Cloud-Services von Microsoft auch im eigenen Rechenzentrum betrieben werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Azure ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren und Daten falsch darzustellen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0362 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0362.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0362 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0362"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2024-02-13",
        "url": "https://msrc.microsoft.com/update-guide"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft Azure: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-02-13T23:00:00.000+00:00",
      "generator": {
        "date": "2026-07-16T16:58:59.814+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2024-0362",
      "initial_release_date": "2024-02-13T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-02-13T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Active Directory B2C",
                "product": {
                  "name": "Microsoft Azure Active Directory B2C",
                  "product_id": "T032724",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure:active_directory_b2c"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Connected Machine Agent",
                "product": {
                  "name": "Microsoft Azure Connected Machine Agent",
                  "product_id": "T032725",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure:connected_machine_agent"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "File Sync v14.0",
                "product": {
                  "name": "Microsoft Azure File Sync v14.0",
                  "product_id": "T032726",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure:file_sync_v14.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "File Sync v15.0",
                "product": {
                  "name": "Microsoft Azure File Sync v15.0",
                  "product_id": "T032727",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure:file_sync_v15.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "File Sync v16.0",
                "product": {
                  "name": "Microsoft Azure File Sync v16.0",
                  "product_id": "T032728",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure:file_sync_v16.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "File Sync v17.0",
                "product": {
                  "name": "Microsoft Azure File Sync v17.0",
                  "product_id": "T032729",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure:file_sync_v17.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Kubernetes Service Confidential Containers",
                "product": {
                  "name": "Microsoft Azure Kubernetes Service Confidential Containers",
                  "product_id": "T032730",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure:kubernetes_service_confidential_containers"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Site Recovery",
                "product": {
                  "name": "Microsoft Azure Site Recovery",
                  "product_id": "T032731",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure:site_recovery"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Azure"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2022.1",
                "product": {
                  "name": "Microsoft Azure DevOps Server 2022.1",
                  "product_id": "T031700",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:microsoft:azure_devops_server:2022.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Azure DevOps Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Hub",
                "product": {
                  "name": "Microsoft Azure Stack Hub",
                  "product_id": "T032732",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:azure_stack:hub"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Stack"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-21403",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-21403"
    },
    {
      "cve": "CVE-2024-21401",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-21401"
    },
    {
      "cve": "CVE-2024-21397",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-21397"
    },
    {
      "cve": "CVE-2024-21381",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-21381"
    },
    {
      "cve": "CVE-2024-21376",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-21376"
    },
    {
      "cve": "CVE-2024-21364",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-21364"
    },
    {
      "cve": "CVE-2024-21329",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-21329"
    },
    {
      "cve": "CVE-2024-20679",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-20679"
    },
    {
      "cve": "CVE-2024-20667",
      "product_status": {
        "known_affected": [
          "T032731",
          "T032732",
          "T032730",
          "T031700",
          "T032724",
          "T032725",
          "T032728",
          "T032729",
          "T032726",
          "T032727"
        ]
      },
      "release_date": "2024-02-13T23:00:00.000+00:00",
      "title": "CVE-2024-20667"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.