Improper access control in Microsoft products - CVE-2024-28917

Vulnerability identifier: #VU88367

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-28917

CWE-ID: CWE-284

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in Azure Arc-enabled Kubernetes Extension Cluster-Scope. A remote administrator on the local network can bypass implemented security restrictions and gain access to sensitive information.

Azure Arc Cluster microsoft.videoindexer Extension
Azure Arc Cluster microsoft.openservicemesh Extension
Azure Arc Cluster microsoft.networkfabricserviceextension Extension
Azure Arc Cluster microsoft.iotoperations.mq Extension
Azure Arc Cluster microsoft.azurekeyvaultsecretsprovider Extension
Azure Arc Cluster microsoft.azure.hybridnetwork Extension
Azure Arc Cluster microsoft.azstackhci.operator Extension

Install updates from vendor's website.

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28917

• Information disclosure in Microsoft Azure Arc-enabled Kubernetes Extensions