CVE-2024-38204 Imagine Cup site Information Disclosure Vulnerability
An authorized attacker can elevate privileges in the Imagine Cup site hosted on Microsoft Azure Functions due to improper access control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-38204?
CVE-2024-38204 is a high-severity vulnerability in Microsoft Azure Functions, published on 15 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.
Weakness: CWE-284
Which versions are affected by CVE-2024-38204?
It affects 1 product.
Products include Microsoft Azure Functions.
How do I fix CVE-2024-38204?
No fix has been published for CVE-2024-38204 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-38204 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-38204 exists.
Other vulnerabilities in Microsoft Azure Functions
Sources
Also known as GHSA-q659-9q97-phj4.