Skip to content
OpenAdvisories
High MSRC-CVE-2023-23382 1 CVE

Azure Machine Learning Compute Instance Information Disclosure Vulnerability

Published Feb 14, 2023 · Updated Aug 22, 2023 · Revision 3

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How do I check my Azure Machine Learning Compute Instance runtime version?
To determine your runtime version, make a GET compute rest API call for your compute instance, then check the response. You can find the runtime version from field *versions.runtime. *
Please view additional details here: https://learn.microsoft.com/en-us/rest/api/azureml/2023-04-01/compute/get
Please reference the guidance provided here: https://learn.microsoft.com/en-us/rest/api/azureml/2023-04-01/compute/update

What type of information could be disclosed by this vulnerability?
An attacker that successfully exploited this vulnerability could recover any data that is put in the system logs on the Compute Instance including cleartext passwords.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
An attacker must be authenticated and have read privileges to the logs which may contain sensitive information such as cleartext passwords. It does not require admin or other elevated privileges.

Security updates
3.0.02076.0001 — https://azure.microsoft.com/en-us/products/machine-learning/

Vulnerabilities 1

  • Medium 6.5

    Azure Machine Learning Compute Instance Information Disclosure Vulnerability

    Azure Machine Learning Compute Instance Information Disclosure Vulnerability

Revision history

  1. #3

    Corrected one or more links in the FAQ. This is an informational change only.

  2. #2

    Added FAQ information. This is an informational change only.

  3. #1

    Information published.

References