CVE-2024-43602HighCVSS 9.9

Azure CycleCloud Remote Code Execution Vulnerability

Published
November 12, 2024
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2024-43602 →

📋 Description

How could an attacker exploit this vulnerability? An attacker with basic user permissions can send specially crafted requests to modify the configuration of an Azure CycleCloud cluster to gain Root level permissions enabling them to execute commands on any Azure CycleCloud cluster in the current instance and in some scenarios, compromise administrator credentials.

🎯 Affected products18

  • Azure CycleCloud 8.0.0
  • Azure CycleCloud 8.0.1
  • Azure CycleCloud 8.0.2
  • Azure CycleCloud 8.1.0
  • Azure CycleCloud 8.1.1
  • Azure CycleCloud 8.2.0
  • Azure CycleCloud 8.2.1
  • Azure CycleCloud 8.2.2
  • Azure CycleCloud 8.3.0
  • Azure CycleCloud 8.4.0
  • Azure CycleCloud 8.4.1
  • Azure CycleCloud 8.4.2
  • Azure CycleCloud 8.5.0
  • Azure CycleCloud 8.6.0
  • Azure CycleCloud 8.6.1
  • Azure CycleCloud 8.6.2
  • Azure CycleCloud 8.6.3
  • Azure CycleCloud 8.6.4

✅ Remediation

KBRelease Notes (Security Update) — fixed build 8.6.5

🔗 References (3)