Azure Ai Search
Monthly
Privilege elevation via server-side request forgery affects Microsoft Azure AI Search, allowing an already-authorized, low-privileged attacker to coerce the service into making crafted network requests to internal or restricted endpoints. By abusing this SSRF, an attacker can reach backend resources and metadata services normally unreachable from their privilege tier, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and the EPSS score of 0.38% (31st percentile) alongside a CISA SSVC 'Exploitation: none' rating indicates no observed exploitation yet.
Azure AI Search Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Privilege elevation via server-side request forgery affects Microsoft Azure AI Search, allowing an already-authorized, low-privileged attacker to coerce the service into making crafted network requests to internal or restricted endpoints. By abusing this SSRF, an attacker can reach backend resources and metadata services normally unreachable from their privilege tier, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and the EPSS score of 0.38% (31st percentile) alongside a CISA SSVC 'Exploitation: none' rating indicates no observed exploitation yet.
Azure AI Search Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.