KLA20234 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to obtain sensitive information, gain privileges, execute arbitrary code, spoof user interface.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in Azure Machine Learning Compute Instance can be exploited remotely to obtain sensitive information.
2. An elevation of privilege vulnerability in Azure App Service on Azure Stack Hub can be exploited remotely to gain privileges.
3. A remote code execution vulnerability in Azure Data Box Gateway can be exploited remotely to execute arbitrary code.
4. A spoofing vulnerability in Azure DevOps Server 2022 can be exploited remotely to spoof user interface.

Original advisories

CVE-2023-23382

CVE-2023-21777

CVE-2023-21703

CVE-2023-21564

Related products

Microsoft-Edge

Microsoft-Azure

CVE list

CVE-2023-23382 high

CVE-2023-21777 critical

CVE-2023-21703 high

CVE-2023-21564 high

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Azure App Service on Azure Stack HubAzure Data Box GatewayAzure Stack EdgeAzure DevOps Server 2022Azure Machine Learning