Azure Functions
CVE-2024-49052
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network. Affected products include: Microsoft Azure Functions.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Require authentication for all sensitive operations, implement defense in depth.
More in Azure Functions
View allAzure Function Information Disclosure Vulnerability [CVSS 8.2 HIGH]
Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute c
Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network. Rated medium
<p>An elevation of privilege vulnerability exists in the way Azure Functions validate access keys.</p> <p>An unauthentic
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today