CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
75.1%
Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the &
or |
symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | azure-cli | < 2.45.0-1 | azure-cli_2.45.0-1_all.deb |
Debian | 11 | all | azure-cli | < 2.18.0-2 | azure-cli_2.18.0-2_all.deb |
Debian | 999 | all | azure-cli | < 2.64.0-1 | azure-cli_2.64.0-1_all.deb |
Debian | 13 | all | azure-cli | < 2.64.0-1 | azure-cli_2.64.0-1_all.deb |