Azure cli - Command Injection - CVE-2022-39327 - CVSS 9.8 (critical)

[fooinha]

Could this be a candidate entry to this database?

• https://github.com/Azure/azure-cli/security/advisories/GHSA-47xc-9rr2-q7p4
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-39327
• https://nvd.nist.gov/vuln/detail/CVE-2022-39327

This vulnerability is in the azure cli, but this command can, eventually be used in hosted machines.

Advisory contains ...

Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source.

For instance, az keyvault secret command line could be used by software releases build pipelines and powershell scripts.

This vulnerability would require the customer to update Azure cli to version >= 2.40.0

[korniko98]

Yes, this is in scope - would you like to create a pull request with the details? (you can use this format)