CVE-2024-49035
Microsoft Partner Center Improper Access Control Vulnerability
Description
CVE-2024-49035 is a high-severity improper access control vulnerability in Microsoft Partner Center (Partner.Microsoft.com) that allows an unauthenticated attacker to elevate privileges over a network. Rated with a CVSS v3.1 base score of 8.7, this flaw enables cross-site privilege escalation with high impact to both confidentiality and integrity. CISA has added CVE-2024-49035 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 18, 2025, confirming active exploitation in the wild. The EPSS score of 6.16% at the 90.6th percentile indicates a significantly elevated probability of exploitation compared to most vulnerabilities, reinforcing the urgency of immediate remediation for all organizations using Microsoft Partner Center.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | partner center | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-49035(US Government Resource)
Weakness Type
Improper Access Control
CVE-2024-49035 stems from an improper access control weakness in Microsoft Partner Center. This class of vulnerability occurs when software does not properly restrict access to resources or functionality, allowing unauthorized actors to perform actions or access data beyond their intended permission level. In the case of Partner.Microsoft.com, the access control mechanisms fail to adequately validate user authorization, enabling an attacker with low-level privileges to escalate to higher privilege levels across the application boundary. The changed scope (S:C) in the CVSS vector indicates that the vulnerability impacts resources beyond the vulnerable component's security authority.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2024-49035 presents a serious risk to organizations relying on Microsoft Partner Center for managing their partner relationships and licensing. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), requiring only low-level privileges (PR:L) and user interaction (UI:R), but critically the scope is changed (S:C), meaning the impact extends beyond the vulnerable component itself. Confidentiality (High): A successful privilege escalation attack enables the attacker to access sensitive partner data, customer records, licensing information, and business-critical configurations that would normally be restricted to administrative users. Integrity (High): With elevated privileges, an attacker can modify partner agreements, alter billing configurations, change subscription management settings, and manipulate customer-facing data within the Partner Center ecosystem. Availability: While the CVSS vector indicates no direct availability impact (A:N), the business consequences of unauthorized modifications to partner configurations could disrupt operations significantly. The EPSS score of 6.16% at the 90.6th percentile combined with KEV catalog inclusion confirms that threat actors are actively targeting this vulnerability, and the ransomware status remains unknown, meaning it could potentially be leveraged as part of broader ransomware campaigns.
Exploit Maturity
CVE-2024-49035 demonstrates confirmed exploit maturity. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming that active exploitation has been observed in the wild. The KEV entry assigns a remediation deadline of March 18, 2025, and lists the ransomware use status as Unknown, indicating that while ransomware exploitation has not been confirmed, it has also not been ruled out. The EPSS score of 6.16% at the 90.6th percentile places this vulnerability well above the majority of tracked CVEs in terms of exploitation probability, suggesting that threat actors are actively developing and deploying exploit techniques. Microsoft has published a security advisory confirming the vulnerability and providing remediation guidance. No public proof-of-concept exploits have been widely distributed, but the KEV listing confirms that operational exploits exist in the threat landscape.
Remediation
-
Apply Microsoft's security update immediately. Visit the Microsoft Security Response Center advisory for CVE-2024-49035 and apply all recommended patches and mitigations. Since Partner Center is a cloud-hosted service, verify with Microsoft that your tenant has received the server-side fix.
-
Audit Partner Center access logs. Review all administrative and user activity logs within Microsoft Partner Center for any suspicious privilege escalation events, unauthorized configuration changes, or anomalous access patterns that may indicate prior exploitation.
-
Enforce least-privilege access controls. Review and tighten role assignments within Partner Center, ensuring that all user accounts operate with the minimum necessary permissions. Remove any stale or unnecessary accounts, particularly those with elevated roles.
-
Enable multi-factor authentication (MFA). Ensure that MFA is enforced for all Partner Center accounts, especially those with administrative or privileged access. This adds an additional layer of defense even if an attacker achieves initial access through this vulnerability.
-
Monitor for indicators of compromise. Implement enhanced monitoring for Partner Center activities, including alerts for privilege changes, new account creation, and modifications to partner configurations. Cross-reference with Microsoft Entra ID (Azure AD) sign-in logs for suspicious authentication events.
Technical Details
CVE-2024-49035 is an improper access control vulnerability in Microsoft's Partner Center web application hosted at Partner.Microsoft.com. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N breaks down as follows: Attack Vector (Network): The vulnerability is exploitable remotely over the network through the Partner Center web interface, requiring no physical or local access. Attack Complexity (Low): Exploitation does not require specialized conditions or additional information gathering beyond standard web interaction. Privileges Required (Low): An attacker needs only a low-privileged account on the Partner Center platform, such as a basic partner user account, to initiate the attack. User Interaction (Required): Some form of user interaction is necessary to trigger the privilege escalation, potentially through a crafted request or link that the target user must interact with. Scope (Changed): This is a critical aspect of the vulnerability — the privilege escalation crosses a trust boundary, meaning the attacker gains access to resources or privileges managed by a different security authority than the vulnerable component. Confidentiality and Integrity (High): Successful exploitation grants the attacker access to read and modify data across the Partner Center tenant, including partner agreements, customer data, and administrative configurations. The underlying mechanism involves insufficient validation of authorization tokens or session attributes during privilege-sensitive operations, allowing an attacker to manipulate request parameters to assume higher-privileged roles within the Partner Center hierarchy.
Frequently Asked Questions
Is CVE-2024-49035 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2024-49035 in the Known Exploited Vulnerabilities catalog with a remediation deadline of March 18, 2025. The EPSS score of 6.16% at the 90.6th percentile further corroborates elevated exploitation activity in the wild.
What is the impact of CVE-2024-49035?
CVE-2024-49035 allows an attacker with low-level privileges to escalate to higher privileges within Microsoft Partner Center. This can lead to unauthorized access to sensitive partner data, customer records, licensing information, and the ability to modify critical business configurations. The changed scope means the impact extends beyond the initially vulnerable component.
How do I fix CVE-2024-49035?
Apply the security update from Microsoft by following the guidance in the official MSRC advisory. Since Partner Center is a cloud service, verify with Microsoft that your tenant has received the fix. Additionally, audit access logs for signs of prior exploitation and enforce least-privilege access controls with multi-factor authentication.
Is CVE-2024-49035 used in ransomware attacks?
The ransomware exploitation status for CVE-2024-49035 is currently listed as Unknown by CISA. While ransomware usage has not been confirmed, the privilege escalation nature of this vulnerability could potentially be leveraged as part of a broader attack chain leading to ransomware deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.