Partner.Microsoft.Com Elevation of Privilege Vulnerability
CVE-2024-49035 is an elevation of privilege vulnerability in Microsoft Partner Center (rated Critical, CVSS 8.7). Microsoft reports that it is being exploited. Microsoft fixed it in the service; customers need to do nothing.
Exploited1 version
Facts
- Microsoft id
CVE-2024-49035- Status
- Exploited
- Products
- Microsoft Partner Center
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 8.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
- Exploited
- Yes
- Publicly disclosed
- No
- Exploitability
- Exploitation Detected
- Customer action required
- No
- Release
- 2024-Nov
- Assigned by
- Microsoft
- Weakness
- CWE-269: Improper Privilege Management
- MSRC revision
- 1.1
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2024-11-26:
Information published.
- Revision 1.1, 2024-11-27:
Corrected **Exploited** to Yes. This is an informational change only.
Microsoft says
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
As first seen: Exploited
- Status
- Exploited
Seen by us · Microsoft's timestamp · Microsoft's page