CVE-2024-49035

Published Nov 26, 2024

Last updated 5 hours ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-49035 is an improper access control vulnerability found in Microsoft Partner Center (partner.microsoft.com). This flaw allows unauthenticated attackers to gain elevated privileges over a network. The vulnerability was disclosed by Microsoft in November 2024. Microsoft credited Gautam Peri, Apoorv Wadhwa, and an anonymous researcher for reporting the vulnerability. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities Catalog, indicating it has been observed being actively exploited in the wild.

Description: An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
Source: secure@microsoft.com
NVD status: Analyzed
CNA Tags: exclusively-hosted-service

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Microsoft Partner Center Improper Access Control Vulnerability
Exploit added on: Feb 25, 2025
Exploit action due: Mar 18, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-269
nvd@nist.gov: NVD-CWE-Other

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 13

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:partner_center:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A400A527-15CD-4F9D-A42D-A453ABE04769"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]