Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-39327
HistoryOct 25, 2022 - 12:00 a.m.

CVE-2022-39327

2022-10-2500:00:00
ubuntu.com
ubuntu.com
20
azure cli
code injection
windows machine
powershell
vulnerability
upgrade

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

75.1%

Azure CLI is the command-line interface for Microsoft Azure. In versions
previous to 2.40.0, Azure CLI contains a vulnerability for potential code
injection. Critical scenarios are where a hosting machine runs an Azure CLI
command where parameter values have been provided by an external source.
The vulnerability is only applicable when the Azure CLI command is run on a
Windows machine and with any version of PowerShell and when the parameter
value contains the & or | symbols. If any of these prerequisites are
not met, this vulnerability is not applicable. Users should upgrade to
version 2.40.0 or greater to receive a a mitigation for the vulnerability.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchazure-cli< anyUNKNOWN

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

75.1%