Strix
26.1K

CVE-2019-1372

CRITICALCVSS 10/10EPSS 17.83%

Last modified

CVE-2019-1372 is a critical-severity vulnerability rated 10/10 on the CVSS scale. An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system thereby escaping the Sandbox.The security update addresses the vulnerability by ensuring that Azure App Service sanitizes user inputs., aka 'Azure App Service Remote Code Execution Vulnerability'.. EPSS estimates a 17.83% chance of exploitation in the next 30 days.

Description

An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system thereby escaping the Sandbox.The security update addresses the vulnerability by ensuring that Azure App Service sanitizes user inputs., aka 'Azure App Service Remote Code Execution Vulnerability'.

Metrics

CVSS 3.1
10/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Probability
17.83%

96.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
MicrosoftAzure App Service On Azure Stack< 1.7

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-1372?
An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system thereby escaping the Sandbox.The security update addresses the vulnerability by ensuring that Azure App Service sanitizes user inputs., aka 'Azure App Service Remote Code Execution Vulnerability'.
How severe is CVE-2019-1372?
CVE-2019-1372 has a CVSS score of 10/10 (CRITICAL severity). The EPSS model estimates a 17.83% probability of exploitation in the next 30 days.
How do I fix CVE-2019-1372?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-1372?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST