{"id":"CVE-2024-21330","state":"PUBLISHED","title":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","description":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","publishedAt":"2024-03-12T16:57:56.930Z","updatedAt":"2025-05-03T00:46:57.058Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft System Center Operations Manager (SCOM) 2019","Microsoft System Center Operations Manager (SCOM) 2022","Microsoft Azure Automation","Microsoft Azure Automation Update Management","Microsoft Azure Sentinel","Microsoft Container Monitoring Solution","Microsoft Azure HDInsight","Microsoft Open Management Infrastructure","Microsoft Azure Security Center","Microsoft Log Analytics Agent"],"affected":[{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2019","versions":[{"version":"10.19.0","status":"affected","lessThan":"10.19.1253.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2022","versions":[{"version":"10.22.0","status":"affected","lessThan":"10.22.1070.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Automation","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA 1.19.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Automation Update Management","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.19.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Sentinel","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.19.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Container Monitoring Solution","versions":[{"version":"1.0.0","status":"affected","lessThan":"microsoft-oms-latest with full ID: sha256:855bfeb0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure HDInsight","versions":[{"version":"1.0","status":"affected","lessThan":"omi-1.8.1-0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"16.0","status":"affected","lessThan":"OMI version 1.8.1-0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"1.0.0","status":"affected","lessThan":"1.8.1-0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Security Center","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA 1.19.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Log Analytics Agent","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.19.0","versionType":"custom"}],"platforms":["Unknown"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330"],"weaknesses":["CWE-122"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/21xxx/CVE-2024-21330.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-21330","state":"PUBLISHED","datePublished":"2024-03-12T16:57:56.930Z","dateUpdated":"2025-05-03T00:46:57.058Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2023-12-08T22:45:19.370Z"},"containers":{"cna":{"title":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","descriptions":[{"lang":"en-US","value":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2019","versions":[{"version":"10.19.0","status":"affected","lessThan":"10.19.1253.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM) 2022","versions":[{"version":"10.22.0","status":"affected","lessThan":"10.22.1070.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Automation","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA 1.19.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Automation Update Management","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.19.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Sentinel","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.19.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Container Monitoring Solution","versions":[{"version":"1.0.0","status":"affected","lessThan":"microsoft-oms-latest with full ID: sha256:855bfeb0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure HDInsight","versions":[{"version":"1.0","status":"affected","lessThan":"omi-1.8.1-0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"16.0","status":"affected","lessThan":"OMI version 1.8.1-0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"1.0.0","status":"affected","lessThan":"1.8.1-0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Azure Security Center","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA 1.19.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Log Analytics Agent","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.19.0","versionType":"custom"}],"platforms":["Unknown"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330","name":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"CWE-122: Heap-based Buffer Overflow","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2025-05-03T00:46:57.058Z"},"datePublic":"2024-03-12T07:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*","versionStartIncluding":"10.19.0","versionEndExcluding":"10.19.1253.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:system_center_operations_manager:*:-:*:*:*:*:*:*","versionStartIncluding":"10.22.0","versionEndExcluding":"10.22.1070.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_automation:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA 1.19.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.19.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.19.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"microsoft-oms-latest with full ID: sha256:855bfeb0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_hdinsights:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0","versionEndExcluding":"omi-1.8.1-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0","versionEndExcluding":"OMI version 1.8.1-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:open_management_suite_agent_for_linux:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.8.1-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA 1.19.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.19.0"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-21330","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-03-12T19:23:30.888206Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:37:56.602Z"}},{"title":"CVE Program Container","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330","name":"Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T22:20:40.316Z"}}]}}}