Critical severity · published Oct 10, 2019
CVE-2019-1372
An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to it.An attacker who…
10.0
CVSS
18.5%
EPSS
No
On KEV
Description
An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system thereby escaping the Sandbox.The security update addresses the vulnerability by ensuring that Azure App Service sanitizes user inputs., aka 'Azure App Service Remote Code Execution Vulnerability'.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)18.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Azure App Service ON Azure Stack · Microsoft
before 1.7 · source: NVD
Affected product
AA
Azure App Service ON Azure Stack
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1372
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1372
research.checkpoint.com
https://research.checkpoint.com/2020/remote-cloud-execution-critical-vulnerabilities-in-azure-cloud-infrastructure-part-ii/
More from Azure App Service ON Azure Stack
8.7
CVE-2023-21777
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
6.1
CVE-2018-8600
A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service Cross-site…
5.5
CVE-2025-53765
Azure Stack Hub Information Disclosure Vulnerability