PT-2023-6965 · Microsoft · Azure Cli
Aviad Hahami
·
Publicado
2023-11-14
·
Atualizado
2025-07-03
·
CVE-2023-36052
CVSS v3.1
8.6
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Azure CLI versions prior to the fixed version
Description
The issue is related to a lack of protection for service data in the Azure CLI interface, which can be exploited by a remote attacker to gain access to credentials. The estimated number of potentially affected devices is not specified. There have been reports of this issue being exploited in real-world incidents, but details are not provided. Technical details about exploitation include the potential for information disclosure through REST commands. The
username and password variables may be vulnerable, but specific details are not provided. The /api/v1/login endpoint may be affected, but this is not explicitly stated.Recommendations
As a temporary workaround, consider disabling the use of REST commands in the Azure CLI until a patch is available. Restrict access to sensitive credentials to minimize the risk of exploitation. Avoid using the
username and password variables in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Azure Cli