Information disclosure in Microsoft products - CVE-2023-36052

Vulnerability identifier: #VU83107

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36052

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Azure CLI REST Command. A remote attacker can gain unauthorized access to sensitive information on the system.

az webapp config appsettings set
az webapp config appsettings delete
az staticwebapp appsettings set
az staticwebapp appsettings delete
az logicapp config appsettings set
az logicapp config appsettings delete
az functionapp config appsettings set
az functionapp config appsettings delete

Install updates from vendor's website.

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36052

• Information disclosure in Microsoft Azure CLI REST Command