Azure Api Center
Monthly
Information disclosure in Microsoft's Azure API Center lets remote unauthenticated attackers read sensitive data outside their intended authorization scope, with the changed-scope (S:C) rating indicating the leak can cross the vulnerable component's security boundary - consistent with a multi-tenant, Microsoft-operated cloud service. Microsoft's CNA vector scores 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C), while our independent assessment narrows impact to confidentiality only (I:N) and keeps the high attack complexity, meaning attacker-controlled preconditions such as target-specific knowledge or request sequencing are required; there is no public exploit identified at time of analysis and no CISA KEV listing. Because the service is vendor-operated SaaS, exposure was bounded by the window before Microsoft's server-side fix was deployed, and customers cannot self-mitigate beyond relying on that fix.
Information disclosure in Microsoft's Azure API Center lets remote unauthenticated attackers read sensitive data outside their intended authorization scope, with the changed-scope (S:C) rating indicating the leak can cross the vulnerable component's security boundary - consistent with a multi-tenant, Microsoft-operated cloud service. Microsoft's CNA vector scores 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C), while our independent assessment narrows impact to confidentiality only (I:N) and keeps the high attack complexity, meaning attacker-controlled preconditions such as target-specific knowledge or request sequencing are required; there is no public exploit identified at time of analysis and no CISA KEV listing. Because the service is vendor-operated SaaS, exposure was bounded by the window before Microsoft's server-side fix was deployed, and customers cannot self-mitigate beyond relying on that fix.