High
Security advisory
Open Management Infrastructure Elevation of Privilege Vulnerability
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-38648
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:25 UTC · Revision 1
Source evidence
Open Management Infrastructure Elevation of Privilege Vulnerability
osv:CVE-2021-38648
Complete source record
{
"id": "af609001f06cd6065a488c889067cdb7b51812106add0dfa1b03e7b0485f4633",
"url": "https://osv.dev/vulnerability/CVE-2021-38648",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-38648",
"summary": "Open Management Infrastructure Elevation of Privilege Vulnerability",
"evidence": "osv:CVE-2021-38648",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-38648",
"aliases": [
"CVE-2021-38648"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/microsoft/omi",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.6.8-1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.6.8-0",
"v1.6.7-0",
"v1.6.6-0",
"v1.6.5-0",
"v1.6.4-1",
"v1.6.4-0",
"v1.6.2",
"v1.6.1-0",
"v1.6.0",
"v1.5.0",
"v1.4.4",
"v1.4.3-2",
"v1.4.3-1",
"v1.4.3",
"v1.4.2-1",
"v1.4.1-0",
"v1.4.0-6",
"v1.3.0-2",
"v1.2.0-35",
"v1.0.8-6",
"v1.1.0-0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38648.json",
"vanir_signatures": [
{
"id": "CVE-2021-38648-008dc9db",
"digest": {
"length": 683,
"function_hash": "162269167150493627019868074985816432074"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.c",
"function": "_SendAuthResponse"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-047d8965",
"digest": {
"length": 251,
"function_hash": "204635758016740555691592169614497387230"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.c",
"function": "_ProcessPamCheckUserResp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-14bd1a50",
"digest": {
"length": 4691,
"function_hash": "169557280295892769181980650258891294425"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.c",
"function": "_ProcessReceivedMessage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-4918fb3f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"271504739194610036912456540681657099016",
"7545253100261969648869691153228239956",
"18749941215262244619080600396852797423",
"56333546979381004515515984699084014745"
]
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-4ae90237",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313478985022960783998607078190212228863",
"57969247623981849610141542759926360411",
"217588714389626790431612447810701179904",
"39026852154188567098167050589066320112",
"50966576885803475655801655947146908979",
"136166596448859572456408461614759428659",
"183475779225641489091563761442140417491",
"128954801053471488760728251397366923246",
"132531806083595378359829970724373567687",
"53756027968303480859893459929943042778",
"123783109968565460252064851143837875959",
"184420845802076278254763431351584720451",
"286205271014569967337837796246908674767",
"132241595198362635920481141421444144216",
"274786380004146169532966425274876993673",
"333011583113295827548457629621961380469",
"66464848382178122739145849880109351942",
"49877124399746273976085696026845270797",
"93797514026975715900380143724277598856",
"258964993438979166948181038948227071375",
"36579264777977680534724787780513078127",
"298635416699266838046376522332014434839",
"105662031857361035932714861581601667076",
"328323365734905985533283378936764308577",
"267775036139631174536787985745433294223",
"293236273411620360308185500978081569456",
"216196089554235834840665665268174676217",
"209345085608318802578054215568299155168",
"170301252088199076495860037051803100996",
"134194152393844963720368669086155990929",
"43836399923194085582164571433879668353",
"312069200174573783827568758465524661050",
"21856253596649868638899641370891348698",
"250474744079484232155283441867418945554",
"172315969730322809389308739008010193697",
"79942335291732112595972693966501394590",
"211859185001052913059792306903156523858",
"119500795106670249669219466438795519038",
"28290356734140469895429018797835034761",
"240641726339560112096200045445653307833",
"299796795839945206582999338607468179532",
"335154310831801032247077443248291488636",
"258035644103300679663529745973955799883",
"246845013559698998459060891333058615662",
"135358043026194842601967742764561355346",
"315901980636351255820710333105599381469",
"205306443741153889680235043948879792886",
"322738528698335177996956666918130389558",
"189284347993996343177288867126652562783",
"161622743530130640580521135648642925063",
"287878057601575856605319419469013961865",
"233289512689744619701694609609248792523",
"175477176395359491353726553919169400645",
"297771449193960493175925764875282116454"
]
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-796fada3",
"digest": {
"length": 1352,
"function_hash": "217807718335855511173167369860693968085"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/http/http.c",
"function": "_ReadData"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-a678af21",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150795980792063409829254987312298558964",
"309423053717453483883350037764534060769",
"210909975569223455253145291958639656032",
"132540073040509447664874737883846916201",
"229848712763039069166164158394836256409",
"169076288507285026684220341090382912047",
"329706401746336992265374527597190091740",
"181044309690113296558382129543936712292"
]
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/base/messages.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-b395d74d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240472139541574427730039340495232397709",
"162238948086719740422868850233350431309",
"191177854154940308246377898641983548755",
"120264513683746604946344778289651352855",
"235350525878720241130038663703492806313",
"35627453137798835916403760933406839821",
"214593626652284039539955812671710912099",
"186621145619910950442101441460434202646",
"252404082664294932253856016853288619206",
"59770835291818304359508703325260838958",
"333268902988043488216187062040961502963",
"2622613298009947629415295550852133191",
"127105711289893577177299030882678001702",
"273245533570510245269111473084485499874"
]
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/http/http.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-ba2b4990",
"digest": {
"length": 684,
"function_hash": "302310494828131017249385248010929507437"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.c",
"function": "_ProcessEngineAuthMessage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-bf5683a0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"295606304598442471339875506516320182025",
"264812748718461868217329534450167935139",
"38407438064275725354396280214349642539",
"258407806404365935575669278129750918374",
"205887140819293442653645260115666800101",
"115761349100072574774724665024845769226",
"190747748423295394382846834087053157474",
"250322166377036499447447479690023448703"
]
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/base/oi_traces.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-c410f7ab",
"digest": {
"threshold": 0.9,
"line_hashes": [
"278286501108309257571086796137303066484",
"288335166381186519040267779851586726302",
"114152311915264464753512738433121510211",
"117973431420040281181646799051033643521",
"298570151840893485885703010964006145932",
"92218430094717642517060102256091907695",
"159183756350937071696392440434600785411",
"56158036290459295273660149486966862824",
"30323749058569641293525612559933284111",
"331089204115371168867079797785835738663",
"251070051575679177357137350771500029606",
"229367395486230179703111173636023808928",
"306455205132604001308655494002133954417",
"41687164953781364918710937590439767170",
"693785887311512335633195606107881827",
"104463172333958615848702053383796128010",
"56017407325313781661504247385380054043",
"92739033925654516913580072068399732294",
"33057915557976494724630895784453966855"
]
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/base/oiomi.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-e0f8a5aa",
"digest": {
"length": 406,
"function_hash": "168640275114321711282903853964064538914"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.c",
"function": "_SendPamCheckUserResp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-e7e31dd7",
"digest": {
"length": 1509,
"function_hash": "184786336945294264915468788765593170439"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.c",
"function": "_ProtocolSocketAndBase_New_Server_Connection"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-ea25c156",
"digest": {
"threshold": 0.9,
"line_hashes": [
"226215268751094784097136930394965618465",
"125143438896525945100869535990019004473",
"133129748656127201049385816899836917924",
"245632929136374031583091323210163604719",
"243918690856398902723527312371840795540",
"84439803892864407962921709368824231454",
"262716688038302620868524373398115696279",
"45317830273252908080144161506675002402",
"134772859427918796215638732171719570109",
"234412281792303765123247229351031648018",
"155919802974878733853288555674367362269"
]
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/base/messages.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-ee12c829",
"digest": {
"length": 810,
"function_hash": "212016841445380398532777469409925560413"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/protocol/protocol.c",
"function": "_ProtocolSocket_Cleanup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-38648-f5b82bb4",
"digest": {
"length": 2672,
"function_hash": "237789250194070545612992539917616677583"
},
"source": "https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa",
"target": {
"file": "Unix/http/http.c",
"function": "_ListenerCallback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:21:17Z"
}
}
],
"modified": "2026-10-24T14:21:17.697082135Z",
"provider": "osv",
"references": [
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38648",
"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-38648",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443623,
"published_at": "2021-09-15T12:15:15.147+00:00"
}