{"id":"CVE-2021-38649","state":"PUBLISHED","title":"Open Management Infrastructure Elevation of Privilege Vulnerability","description":"Open Management Infrastructure Elevation of Privilege Vulnerability","publishedAt":"2021-09-15T11:24:09.000Z","updatedAt":"2026-08-10T15:10:55.453Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Azure Automation State Configuration, DSC Extension","Microsoft Azure Automation Update Management","Microsoft Azure Diagnostics (LAD)","Microsoft Azure Security Center","Microsoft Azure Sentinel","Microsoft Azure Stack Hub","Microsoft Container Monitoring Solution","Microsoft Log Analytics Agent","Microsoft Open Management Infrastructure","Microsoft System Center Operations Manager (SCOM)"],"affected":[{"vendor":"Microsoft","product":"Azure Automation State Configuration, DSC Extension","versions":[{"version":"2.0.0","status":"affected","lessThan":"DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Automation Update Management","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Diagnostics (LAD)","versions":[{"version":"3.0.0","status":"affected","lessThan":"LAD v4.0.13 and LAD v3.0.135","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Security Center","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Sentinel","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Stack Hub","versions":[{"version":"1.0.0","status":"affected","lessThan":"Monitor, Update and Config Mgmnt 1.14.01","versionType":"custom"}]},{"vendor":"Microsoft","product":"Container Monitoring Solution","versions":[{"version":"1.0.0","status":"affected","lessThan":"publication","versionType":"custom"}]},{"vendor":"Microsoft","product":"Log Analytics Agent","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"16.0","status":"affected","lessThan":"OMI Version 1.6.8-1","versionType":"custom"}]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM)","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMI version: 1.6.8-1","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"],"weaknesses":[],"ingestedAt":"2026-10-29T19:48:49.871Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/38xxx/CVE-2021-38649.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-38649","state":"PUBLISHED","datePublished":"2021-09-15T11:24:09.000Z","dateUpdated":"2026-08-10T15:10:55.453Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2021-08-13T00:00:00.000Z"},"containers":{"cna":{"title":"Open Management Infrastructure Elevation of Privilege Vulnerability","descriptions":[{"lang":"en-US","value":"Open Management Infrastructure Elevation of Privilege Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"Azure Automation State Configuration, DSC Extension","versions":[{"version":"2.0.0","status":"affected","lessThan":"DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Automation Update Management","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Diagnostics (LAD)","versions":[{"version":"3.0.0","status":"affected","lessThan":"LAD v4.0.13 and LAD v3.0.135","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Security Center","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Sentinel","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Stack Hub","versions":[{"version":"1.0.0","status":"affected","lessThan":"Monitor, Update and Config Mgmnt 1.14.01","versionType":"custom"}]},{"vendor":"Microsoft","product":"Container Monitoring Solution","versions":[{"version":"1.0.0","status":"affected","lessThan":"publication","versionType":"custom"}]},{"vendor":"Microsoft","product":"Log Analytics Agent","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"16.0","status":"affected","lessThan":"OMI Version 1.6.8-1","versionType":"custom"}]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM)","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMI version: 1.6.8-1","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649","name":"Open Management Infrastructure Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7,"vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"description":"Elevation of Privilege","lang":"en-US","type":"Impact"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-08-10T15:10:55.453Z"},"datePublic":"2021-09-14T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0","versionEndExcluding":"OMI Version 1.6.8-1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:system_center_operations_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMI version: 1.6.8-1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_automation_state_configuration:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.13.40-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.13.40-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"LAD v4.0.13 and LAD v3.0.135"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"publication"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.13.40-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.13.40-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"Monitor, Update and Config Mgmnt 1.14.01"}]}]}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T01:51:19.019Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649","tags":["government-resource"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-38649","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-04T18:09:12.228704Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2021-11-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T23:25:32.826Z"},"timeline":[{"time":"2021-11-03T00:00:00.000Z","lang":"en","value":"CVE-2021-38649 added to CISA KEV"}]}]}}}