CVE-2024-43479

Microsoft Power Automate Desktop Remote Code Execution Vulnerability

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43479	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:power_automate::::::windows::*
	cpe:2.3:a:microsoft:power_automate::::::windows::*
	cpe:2.3:a:microsoft:power_automate::::::windows::*
	cpe:2.3:a:microsoft:power_automate::::::windows::*
	cpe:2.3:a:microsoft:power_automate::::::windows::*
	cpe:2.3:a:microsoft:power_automate::::::windows::*
	cpe:2.3:a:microsoft:power_automate::::::windows::*

History

13 Sep 2024, 14:38

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
References	~~() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43479 -~~	() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43479 - Patch, Vendor Advisory
First Time		Microsoft Microsoft power Automate
Summary		(es) Vulnerabilidad de ejecución remota de código en Microsoft Power Automate Desktop
CPE		cpe:2.3:a:microsoft:power_automate::::::windows::*

10 Sep 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-10 17:15

Updated : 2024-09-13 14:38

NVD link : CVE-2024-43479

Mitre link : CVE-2024-43479

CVE.ORG link : CVE-2024-43479

JSON object : View

Products Affected

microsoft

power_automate

CWE

NVD-CWE-noinfo CWE-284

Improper Access Control

{"id": "CVE-2024-43479", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secure@microsoft.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "published": "2024-09-10T17:15:35.830", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43479", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Power Automate Desktop Remote Code Execution Vulnerability"}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en Microsoft Power Automate Desktop"}], "lastModified": "2024-09-13T14:38:13.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "322F9991-B8B9-4663-A85F-5707690F7EC2", "versionEndExcluding": "2.41.178.24249", "versionStartIncluding": "2.41"}, {"criteria": "cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "474BAB62-900B-4E53-8806-6CF0A00A42C0", "versionEndExcluding": "2.42.331.24249", "versionStartIncluding": "2.42"}, {"criteria": "cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "5149B144-1E46-48C4-A0E4-D52A6FCBCF06", "versionEndExcluding": "2.43.249.24249", "versionStartIncluding": "2.43"}, {"criteria": "cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "E6EB212A-F877-4295-812A-3107CE292ED0", "versionEndExcluding": "2.44.55.24249", "versionStartIncluding": "2.44"}, {"criteria": "cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "1B0733C1-CA8E-444F-ABD8-C3764642E276", "versionEndExcluding": "2.45.404.24249", "versionStartIncluding": "2.45"}, {"criteria": "cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "9FEBB153-D701-4BE4-9711-51CFDE92AA74", "versionEndExcluding": "2.46.181.24249", "versionStartIncluding": "2.46"}, {"criteria": "cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "4F353C0E-6892-4A4A-AEA7-59A778ADC380", "versionEndExcluding": "2.47.119.24249", "versionStartIncluding": "2.47"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}