CVE-2024-21638

    Dashboard / Vulnerabilities / CVE-2024-21638

    CVE-2024-21638

    Published: 10 Jan 2024Last Modified: 12 Aug 2026

    Summary: Azure IPAM solution Elevation of Privilege Vulnerability

    Details: Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.

    References: https://github.com/Azure/ipam/security/advisories/GHSA-m8mp-jq4c-g8j6, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21638.json, https://nvd.nist.gov/vuln/detail/CVE-2024-21638, https://github.com/Azure/ipam/commit/64ef2d07edf16ffa50f29c7e0e25d32d974b367f, https://github.com/Azure/ipam/pull/218

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -3cb86553ac549a5a93708d196119047c52e0abd1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-21638 | CVE-DB