{"id":"CVE-2022-29149","state":"PUBLISHED","title":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","description":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","publishedAt":"2022-06-15T21:51:17.000Z","updatedAt":"2025-01-02T19:03:13.161Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Azure Automation State Configuration, DSC Extension","Microsoft Azure Automation Update Management","Microsoft Log Analytics Agent","Microsoft Azure Diagnostics (LAD)","Microsoft Container Monitoring Solution","Microsoft Azure Security Center","Microsoft Azure Sentinel","Microsoft Azure Stack Hub","Microsoft Open Management Infrastructure","Microsoft System Center Operations Manager (SCOM) 2022","Microsoft System Center Operations Manager (SCOM) 2019","Microsoft System Center Operations Manager (SCOM) 2016"],"affected":[{"vendor":"Microsoft","product":"Azure Automation State Configuration, DSC Extension","versions":[{"version":"2.0.0","status":"affected","lessThan":"DSC Agent versions: 2.71.1.33, 3.0.0.7","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Automation Update Management","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Log Analytics Agent","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Diagnostics (LAD)","versions":[{"version":"3.0.0","status":"affected","lessThan":"LAD v4.0.27 and LAD v3.0.137","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Container Monitoring Solution","versions":[{"version":"1.0.0","status":"affected","lessThan":"publication","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Security Center","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Sentinel","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Stack Hub","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"16.0","status":"affected","lessThan":"OMI Version 1.6.9-1","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2022","versions":[{"version":"10.22.0","status":"affected","lessThan":"10.22.1024.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2019","versions":[{"version":"10.19.0","status":"affected","lessThan":"10.19.1152.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2016","versions":[{"version":"7.6.0","status":"affected","lessThan":"7.6.1108.0","versionType":"custom"}],"platforms":["Unknown"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29149"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:57.813Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/29xxx/CVE-2022-29149.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-29149","state":"PUBLISHED","datePublished":"2022-06-15T21:51:17.000Z","dateUpdated":"2025-01-02T19:03:13.161Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2022-04-12T00:00:00.000Z"},"containers":{"cna":{"title":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","descriptions":[{"lang":"en-US","value":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"Azure Automation State Configuration, DSC Extension","versions":[{"version":"2.0.0","status":"affected","lessThan":"DSC Agent versions: 2.71.1.33, 3.0.0.7","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Automation Update Management","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Log Analytics Agent","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Diagnostics (LAD)","versions":[{"version":"3.0.0","status":"affected","lessThan":"LAD v4.0.27 and LAD v3.0.137","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Container Monitoring Solution","versions":[{"version":"1.0.0","status":"affected","lessThan":"publication","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Security Center","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Sentinel","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Stack Hub","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.14.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"16.0","status":"affected","lessThan":"OMI Version 1.6.9-1","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2022","versions":[{"version":"10.22.0","status":"affected","lessThan":"10.22.1024.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2019","versions":[{"version":"10.19.0","status":"affected","lessThan":"10.19.1152.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2016","versions":[{"version":"7.6.0","status":"affected","lessThan":"7.6.1108.0","versionType":"custom"}],"platforms":["Unknown"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149","name":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"description":"Elevation of Privilege","lang":"en-US","type":"Impact"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2025-01-02T19:03:13.161Z"},"datePublic":"2022-06-14T07:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_automation_state_configuration:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"DSC Agent versions: 2.71.1.33, 3.0.0.7"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.14.13"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.14.13"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"LAD v4.0.27 and LAD v3.0.137"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"publication"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.14.13"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.14.13"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.14.13"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0","versionEndExcluding":"OMI Version 1.6.9-1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*","versionStartIncluding":"10.22.0","versionEndExcluding":"10.22.1024.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*","versionStartIncluding":"10.19.0","versionEndExcluding":"10.19.1152.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*","versionStartIncluding":"7.6.0","versionEndExcluding":"7.6.1108.0"}]}]}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29149","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T06:10:59.490Z"}}]}}}