Back
CVE-2019-1372
CRITICAL
An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system thereby escaping the Sandbox.The security update addresses the vulnerability by ensuring that Azure App Service sanitizes user inputs., aka 'Azure App Service Remote Code Execution Vulnerability'.
Published: Oct 10, 2019
Modified: Jun 17, 2026
NVD-CWE-noinfo
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products (1)
| Vendor | Product | Version |
|---|---|---|
| microsoft | azure_app_service_on_azure_stack | * < 1.7 |
GitHub Security Advisory GHSA-649f-8c3w-9g8g
An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack...
References (4)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1372 Patch, Vendor Advisory
- https://research.checkpoint.com/2020/remote-cloud-execution-critical-vulnerabilities-in-azure-cloud-infrastructure-part-ii/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1372 Patch, Vendor Advisory
- https://research.checkpoint.com/2020/remote-cloud-execution-critical-vulnerabilities-in-azure-cloud-infrastructure-part-ii/
Risk Scores
CVSS Score
10.0 / 10
EPSS Score
19.03%
Top 3% most likely to be exploited
Threat Score
45.7 / 100
Data Sources
NVD
EPSS
GitHub