CVE-2024-21330
highpriority · track · 0EPSS 0.010 · 62 %ileDEEURUUSEPSS · scored 2026-10-27
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedAzure Automationmsrc_csaf
OMS Agent for Linux GA 1.19.0:Security Update:https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment - FixedAzure Automation Update Managementmsrc_csaf
OMS Agent for Linux GA v1.19.0:Security Update:https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment - FixedAzure HDInsightmsrc_csaf
omi-1.8.1-0:Security Update:https://learn.microsoft.com/en-us/azure/hdinsight/hdinsight-release-notes
https://learn.microsoft.com/en-us/azure/hdinsight/hdinsight-release-notes - FixedAzure Security Centermsrc_csaf
OMS Agent for Linux GA 1.19.0:Security Update:https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment - FixedAzure Sentinelmsrc_csaf
OMS Agent for Linux GA v1.19.0:Security Update:https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/oms-linux#azure-cli-deployment - FixedContainer Monitoring Solutionmsrc_csaf
microsoft-oms-latest with full ID: sha256:855bfeb0:Security Update:https://github.com/microsoft/containerregistry
https://github.com/microsoft/containerregistry - FixedLog Analytics Agentmsrc_csaf
OMS Agent for Linux GA v1.19.0:Security Update:https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview#azure-cli-deployment
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview#azure-cli-deployment - FixedOpen Management Infrastructuremsrc_csaf
OMI version 1.8.1-0:Security Update:https://github.com/microsoft/omi
https://github.com/microsoft/omi - FixedOperations Management Suite Agent for Linux (OMS)msrc_csaf
1.8.1-0:Security Update:https://github.com/microsoft/OMS-Agent-for-Linux
https://github.com/microsoft/OMS-Agent-for-Linux - FixedSystem Center Operations Manager (SCOM) 2019msrc_csaf
10.19.1253.0:Security Update:https://www.microsoft.com/en-us/download/details.aspx?id=58208
https://www.microsoft.com/en-us/download/details.aspx?id=58208 - FixedSystem Center Operations Manager (SCOM) 2022msrc_csaf
10.22.1070.0:Security Update:https://www.microsoft.com/en-in/download/details.aspx?id=104213
https://www.microsoft.com/en-in/download/details.aspx?id=104213
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (60)
Products and version ranges known to be affected.
- Microsoft Azure Automation Update Managementall versionscert_bundDEcpe:/a:microsoft:azure:automation_update_management
- Microsoft Azure Kubernetes Service Confidential Containersall versionscert_bundDEcpe:/a:microsoft:azure:kubernetes_service_confidential_containers
- Microsoft Windows Defender Antimalware Platformall versionscert_bundDEcpe:/a:microsoft:windows_defender:credential_guard
- Microsoft Container Monitoring Solution1.0.0 → microsoft-oms-latest with full ID: sha256:855bfeb0enisa_euvdEU
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-0612Microsoft Azure: Mehrere SchwachstellenDeutsch2024-03-12csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Azure ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und Informationen falsch darzustellen.
- WID-SEC-W-2024-0620Microsoft System Center: Mehrere SchwachstellenDeutsch2024-03-12csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft System Center ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen und seine Rechte zu erweitern.
- msrc_CVE-2024-21330Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability2024-03-12csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-21330/cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-21330cnnvd
- https://vigilance.fr/vulnerability/Microsoft-System-Center-Operations-Manager-vulnerabilities-of-March-2024-43750cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330enisa_euvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21330Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan