{"id":"CVE-2024-43591","aliases":["BIT-azure-cli-2024-43591","EUVD-2024-40343","GHSA-c675-7cfx-698p","SUSE-SU-2025:0751-1","UBUNTU-CVE-2024-43591"],"status":"published","title":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","description":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01632,"percentile":0.76428,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2024-10-08T17:36:14Z","modified":"2026-10-24T10:30:28Z","fixes":[{"ecosystem":"Bitnami","package":"azure-cli","fixed_in":["2.65.0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"azure-cli","fixed_in":["2.58.0-150400.14.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"azure-cli","fixed_in":["2.58.0-150400.14.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"azure-cli","fixed_in":["2.58.0-150400.14.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"azure-cli-test","fixed_in":["2.58.0-150400.14.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"azure-cli","fixed_in":["2.58.0-150400.14.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"azure-cli-test","fixed_in":["2.58.0-150400.14.12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"azure-cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.65.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"azure-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.0-150400.14.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"azure-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.0-150400.14.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"azure-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.0-150400.14.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"azure-cli-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.0-150400.14.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"azure-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.0-150400.14.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"azure-cli-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.0-150400.14.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"azure-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.81+ds-2","2.0.81+ds-3","2.0.81+ds-4","2.0.81+ds-4ubuntu0.2"]}],"products":[{"vendor":"microsoft","product":"azure cli"},{"vendor":"microsoft","product":"azure service connector"},{"vendor":"microsoft","product":"azure_command-line_interface"},{"vendor":"microsoft","product":"azure_service_connector"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43591","tags":["vendor-advisory","patch","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43591","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c675-7cfx-698p"},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250751-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231971","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43591","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-43591","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-43591","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-43591","title":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","description":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","status":"published","published":"2024-10-08T17:36:14.78Z","modified":"2026-08-19T16:27:13.362Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:33:58.839967Z"}],"euvd":[{"id":"EUVD-2024-40343","description":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","status":"published","published":"2024-10-08T17:36:14Z","modified":"2026-08-19T16:27:13Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T18:01:43.218519Z"}],"ghsa":[{"id":"GHSA-c675-7cfx-698p","title":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","description":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","status":"published","published":"2024-10-08T18:33:17Z","modified":"2024-10-08T18:33:29Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:58:26.788659Z"}],"nvd":[{"id":"CVE-2024-43591","description":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","status":"published","published":"2024-10-08T18:15:27.127Z","modified":"2026-06-17T07:51:21.673Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:10:31.271525Z"}],"osv":[{"id":"CVE-2024-43591","description":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","status":"published","published":"2024-10-08T18:15:27.127Z","modified":"2026-10-24T10:30:28.89597178Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"UBUNTU-CVE-2024-43591","description":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","status":"published","published":"2024-10-08T18:15:00Z","modified":"2025-10-24T05:11:48Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"BIT-azure-cli-2024-43591","title":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","description":"Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability","status":"published","published":"2025-07-03T05:35:49.296Z","modified":"2026-09-08T08:45:39.030815594Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"SUSE-SU-2025:0751-1","title":"Security update for azure-cli","description":"This update for azure-cli fixes the following issues:\n\n- CVE-2024-43591: improper neutralization of special elements could allow users to run Azure CLI commands that result\n  in certain service management operations being performed with System level permissions in Azure Defender for Cloud\n  (bsc#1231971).\n","status":"published","published":"2025-02-28T16:26:23Z","modified":"2026-02-04T04:03:46.823377Z","updated_at":"2026-11-02T15:53:58.883365Z"}]}}