CVE-2023-36052 Azure CLI REST Command Information Disclosure Vulnerability
Attackers can exploit the Azure CLI REST command to disclose sensitive information from Azure App Service, Function App, and Logic App environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36052?
CVE-2023-36052 is a high-severity vulnerability in Microsoft Azure App Service, published on 14 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Azure CLI REST Command Information Disclosure Vulnerability
Weakness: CWE-359
Which versions are affected by CVE-2023-36052?
1 open source package ship an affected version, including azure-cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
azure-cli Bitnami | All versions | 2.53.1 |
Products include Microsoft Azure Command-Line Interface.
How do I fix CVE-2023-36052?
Upgrade azure-cli to 2.53.1 or later.
Is CVE-2023-36052 being exploited?
There is no known exploitation of CVE-2023-36052 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Azure App Service
Sources
Also known as BIT-azure-cli-2023-36052, GHSA-m32x-6xp4-26j2.