Security readout for executives and security teams
Plain-English summary
A critical Azure Site Recovery flaw could let an attacker with local access gain elevated privileges and compromise confidentiality, integrity, and availability. The supplied record identifies Azure Site Recovery 2021 as affected. Organizations using that version should promptly confirm exposure and follow Microsoft’s remediation guidance.
Executive priority
Treat as an urgent remediation item because successful exploitation could cross a security boundary and severely affect protected systems. Prioritize identifying Azure Site Recovery 2021 deployments, then apply Microsoft’s guidance. The absence of KEV evidence reduces certainty about immediate attacks but does not reduce the stated technical severity.
Technical view
CVE-2024-21364 is an elevation-of-privilege vulnerability categorized as CWE-284, improper authorization. Its CVSS 3.1 score is 9.3. The vector describes a local, low-complexity attack requiring no prior privileges or user interaction, with changed scope and high impact across confidentiality, integrity, and availability.
Likely exposure
Exposure is limited to environments running the identified Azure Site Recovery 2021 product version. The bundle provides no CPEs, component details, deployment conditions, or fixed-version information, so asset inventory and Microsoft advisory review are necessary to determine actual exposure.
Exploitation context
The CVSS vector records exploit maturity as proof-of-concept. However, the source bundle provides no supporting exploit details, and the CVE is not listed as KEV. Therefore, active exploitation cannot be claimed from the supplied evidence.
Researcher notes
The supplied evidence establishes severity, attack-vector characteristics, affected product information, CWE classification, and a Microsoft patch reference. It does not describe the vulnerable component, exploitation mechanics, fixed versions, indicators of compromise, or confirmed attacks. Avoid broader product or version assumptions until Microsoft’s advisory supplies them.
Mitigation direction
- Identify deployments using Azure Site Recovery 2021.
- Review Microsoft’s CVE advisory for applicable updates and prerequisites.
- Apply the Microsoft-provided remediation according to change-control procedures.
- Restrict unnecessary local access until remediation is confirmed.
- Monitor Microsoft guidance for revisions or additional affected-version details.
Validation and detection
- Verify deployed Azure Site Recovery versions against Microsoft’s advisory.
- Confirm the applicable Microsoft update completed successfully.
- Recheck affected systems after maintenance or rollback events.
- Review security telemetry for unexplained privilege changes on relevant systems.
- Document systems determined unaffected and the supporting evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-21364 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C2.56microsoftVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Microsoft Azure Site Recovery Elevation of Privilege VulnerabilityCVE reference, microsoft · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.